CVE-2026-48782: Pydantic AI SSRF via IPv6 transition form blocklist bypass

CVE-2026-48782 · Severity: medium · CVSS 6.8 · Published 2026-06-17

Pydantic AI, a library used for building AI applications, contains a vulnerability that could allow attackers to bypass security filters and access sensitive internal cloud credentials. By providing specially formatted web addresses (URLs) using rare network protocols, an attacker can trick the system into connecting to private internal services it is supposed to block. This could lead to the theft of short-term security tokens used to manage cloud infrastructure, though it primarily affects specific network configurations like certain Kubernetes setups.

Technologies: pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48782 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48782 being exploited in the wild.
How severe is CVE-2026-48782?
Medium severity, with a CVSS score of 6.8, published 17 June 2026.
Which products and versions are affected?
pydantic-ai (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.102.0, ECOSYSTEM:introduced=1.56.0,fixed=1.102.0,introduced=2.0.0b1,fixed=2.0.0b3; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.102.0, ECOSYSTEM:introduced=1.56.0,fixed=1.102.0,introduced=2.0.0b1,fixed=2.0.0b3.
Is there a fix for CVE-2026-48782?
Yes. pydantic-ai (PyPI): upgrade to 1.102.0, 2.0.0b3 or later; pydantic-ai-slim (PyPI): upgrade to 1.102.0, 2.0.0b3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48782 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48782?
Check whether you run pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pydantic-ai (PyPI): upgrade to 1.102.0, 2.0.0b3 or later
    pip install "pydantic-ai>=2.0.0b3"
  • pydantic-ai-slim (PyPI): upgrade to 1.102.0, 2.0.0b3 or later
    pip install "pydantic-ai-slim>=2.0.0b3"

Technical details

Pydantic AI fails to properly decode and validate several IPv6 transition forms—including IPv4-compatible IPv6 (::a.b.c.d), NAT64 local-use prefixes (64:ff9b:1::/48), and ISATAP—before checking them against its SSRF blocklist. This is an incomplete fix for CVE-2026-46678. An attacker can bypass the cloud-metadata blocklist by encoding a target IP in one of these forms. The vulnerability is exploitable if the application opts into 'allow-local' for a user-influenced URL and is deployed on a network that routes these specific IPv6 forms (such as NAT64 or ISATAP environments). Successful exploitation allows the retrieval of IAM credentials from cloud metadata services. The issue is patched in versions 1.102.0 and 2.0.0b3.

Affected products

  • pydantic pydantic-ai >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3
  • pydantic pydantic-ai-slim >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3

Identifiers

  • CVE-2026-48782
  • GHSA-cg7w-rg45-pc59
  • PYSEC-2026-2977
  • PYSEC-2026-2981

Timeline

  • 2026-05-23: disclosed
  • 2026-06-17: advisory: NVD publication date
  • 2026-06-26: patched: GitHub Advisory updated/published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.