CVE-2026-54249: Pydantic AI SSRF in UI adapters via UploadedFile references

CVE-2026-54249 · Severity: medium · CVSS 6.8 · Published 2026-07-29

Pydantic AI is a framework for building AI agents. When applications accept untrusted message history from clients and pass it to the framework's UI adapters, an attacker can craft messages containing specially crafted file references that cause the server to fetch arbitrary files from cloud storage accounts (AWS S3, Google Cloud Storage) or model provider accounts using the server's own credentials. This allows an attacker to read sensitive files they should not have access to, including files belonging to other customers.

Technologies: pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54249 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54249 being exploited in the wild.
How severe is CVE-2026-54249?
Medium severity, with a CVSS score of 6.8, published 29 July 2026.
Which products and versions are affected?
pydantic-ai (PyPI) ECOSYSTEM:introduced=1.65.0,fixed=1.106.0, ECOSYSTEM:introduced=1.65.0,fixed=1.106.0,introduced=2.0.0b1,fixed=2.0.0b6; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.65.0,fixed=1.106.0, ECOSYSTEM:introduced=1.65.0,fixed=1.106.0,introduced=2.0.0b1,fixed=2.0.0b6.
Is there a fix for CVE-2026-54249?
Yes. pydantic-ai (PyPI): upgrade to 1.106.0, 2.0.0b6 or later; pydantic-ai-slim (PyPI): upgrade to 1.106.0, 2.0.0b6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54249 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54249?
Check whether you run pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pydantic-ai (PyPI): upgrade to 1.106.0, 2.0.0b6 or later
    pip install "pydantic-ai>=2.0.0b6"
  • pydantic-ai-slim (PyPI): upgrade to 1.106.0, 2.0.0b6 or later
    pip install "pydantic-ai-slim>=2.0.0b6"

Technical details

The vulnerability is a server-side request forgery (SSRF) vulnerability (CWE-918) affecting Pydantic AI's UI adapters. UI adapters validate file URLs against a scheme allowlist before forwarding to model providers, but UploadedFile references (which point to files by provider ID or cloud-storage URI like s3:// or gs://) are forwarded without any validation. The root cause is the inconsistent validation logic: while URL-based file parts are checked, UploadedFile references bypass this protection. An unauthenticated attacker can submit crafted message history containing an arbitrary UploadedFile reference; the model provider then resolves this reference using the server's IAM role, service account, or API key rather than the client's identity, allowing the server to fetch files from its own cloud account or other tenants. Exploitation requires knowledge of a valid file identifier, but depending on naming schemes, such identifiers may be guessable. Patches are available in pydantic-ai 1.106.0 (1.x) and 2.0.0b6 (2.x beta), which add the same validation for UploadedFile references as for URLs.

Affected products

  • Pydantic pydantic-ai >=1.65.0, <1.106.0 or >=2.0.0b1, <2.0.0b6
  • Pydantic pydantic-ai-slim >=1.65.0, <1.106.0 or >=2.0.0b1, <2.0.0b6

Identifiers

  • CVE-2026-54249
  • GHSA-h7p7-w5gc-xj3w
  • PYSEC-2026-3692
  • PYSEC-2026-3693

Timeline

  • 2026-06-10: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-10: patched: Patches released: pydantic-ai 1.106.0 (1.x) and 2.0.0b6 (2.x beta)
  • 2026-08-13: advisory: Advisory GHSA-h7p7-w5gc-xj3w published with CVE-2026-54249

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.