# CVE-2026-48782: Pydantic AI SSRF via IPv6 transition form blocklist bypass

Source: https://junglewise.ai/threats/cve-2026-48782-pydantic-ai-ssrf-via-ipv6-transition-form-blocklist-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48782 · Severity: medium · CVSS 6.8 · Published 2026-06-17

Pydantic AI, a library used for building AI applications, contains a vulnerability that could allow attackers to bypass security filters and access sensitive internal cloud credentials. By providing specially formatted web addresses (URLs) using rare network protocols, an attacker can trick the system into connecting to private internal services it is supposed to block. This could lead to the theft of short-term security tokens used to manage cloud infrastructure, though it primarily affects specific network configurations like certain Kubernetes setups.

Technologies: [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48782 being exploited in the wild.

**How severe is CVE-2026-48782?** Medium severity, with a CVSS score of 6.8, published 17 June 2026.

**Which products and versions are affected?** pydantic-ai (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.102.0, ECOSYSTEM:introduced=1.56.0,fixed=1.102.0,introduced=2.0.0b1,fixed=2.0.0b3; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.56.0,fixed=1.102.0, ECOSYSTEM:introduced=1.56.0,fixed=1.102.0,introduced=2.0.0b1,fixed=2.0.0b3.

**Is there a fix for CVE-2026-48782?** Yes. pydantic-ai (PyPI): upgrade to 1.102.0, 2.0.0b3 or later; pydantic-ai-slim (PyPI): upgrade to 1.102.0, 2.0.0b3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48782 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48782?** Check whether you run pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 1.102.0, 2.0.0b3 or later

  ```sh
  pip install "pydantic-ai>=2.0.0b3"
  ```

- pydantic-ai-slim (PyPI): upgrade to 1.102.0, 2.0.0b3 or later

  ```sh
  pip install "pydantic-ai-slim>=2.0.0b3"
  ```


## Technical details

Pydantic AI fails to properly decode and validate several IPv6 transition forms—including IPv4-compatible IPv6 (::a.b.c.d), NAT64 local-use prefixes (64:ff9b:1::/48), and ISATAP—before checking them against its SSRF blocklist. This is an incomplete fix for CVE-2026-46678. An attacker can bypass the cloud-metadata blocklist by encoding a target IP in one of these forms. The vulnerability is exploitable if the application opts into 'allow-local' for a user-influenced URL and is deployed on a network that routes these specific IPv6 forms (such as NAT64 or ISATAP environments). Successful exploitation allows the retrieval of IAM credentials from cloud metadata services. The issue is patched in versions 1.102.0 and 2.0.0b3.

## Affected products

- pydantic pydantic-ai >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3
- pydantic pydantic-ai-slim >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3

## Identifiers

- CVE-2026-48782
- GHSA-cg7w-rg45-pc59
- PYSEC-2026-2977
- PYSEC-2026-2981

## Timeline

- 2026-05-23: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-06-26: patched: GitHub Advisory updated/published

## References

- [https://api.github.com/users/SnailSploit](https://api.github.com/users/SnailSploit)
- [https://github.com/SnailSploit](https://github.com/SnailSploit)
- [https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D](https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D)
- [https://api.github.com/users/SnailSploit/repos](https://api.github.com/users/SnailSploit/repos)
- [https://avatars.githubusercontent.com/u/95986478?v=4](https://avatars.githubusercontent.com/u/95986478?v=4)
- [https://api.github.com/users/SnailSploit/events%7B/privacy%7D](https://api.github.com/users/SnailSploit/events%7B/privacy%7D)

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)