Executive brief
Pydantic AI, a library used for building AI applications, contains a vulnerability that could allow attackers to bypass security filters and access sensitive internal cloud credentials. By providing specially formatted web addresses (URLs) using rare network protocols, an attacker can trick the system into connecting to private internal services it is supposed to block. This could lead to the theft of short-term security tokens used to manage cloud infrastructure, though it primarily affects specific network configurations like certain Kubernetes setups.
Technical details
Pydantic AI fails to properly decode and validate several IPv6 transition forms—including IPv4-compatible IPv6 (::a.b.c.d), NAT64 local-use prefixes (64:ff9b:1::/48), and ISATAP—before checking them against its SSRF blocklist. This is an incomplete fix for CVE-2026-46678. An attacker can bypass the cloud-metadata blocklist by encoding a target IP in one of these forms. The vulnerability is exploitable if the application opts into 'allow-local' for a user-influenced URL and is deployed on a network that routes these specific IPv6 forms (such as NAT64 or ISATAP environments). Successful exploitation allows the retrieval of IAM credentials from cloud metadata services. The issue is patched in versions 1.102.0 and 2.0.0b3.
Affected products
- pydantic pydantic-ai >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3
- pydantic pydantic-ai-slim >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3
Timeline
- 2026-05-23: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-06-26: patched: GitHub Advisory updated/published