Executive brief
Pydantic AI is a framework for building AI agents. When applications accept untrusted message history from clients and pass it to the framework's UI adapters, an attacker can craft messages containing specially crafted file references that cause the server to fetch arbitrary files from cloud storage accounts (AWS S3, Google Cloud Storage) or model provider accounts using the server's own credentials. This allows an attacker to read sensitive files they should not have access to, including files belonging to other customers.
Technical details
The vulnerability is a server-side request forgery (SSRF) vulnerability (CWE-918) affecting Pydantic AI's UI adapters. UI adapters validate file URLs against a scheme allowlist before forwarding to model providers, but UploadedFile references (which point to files by provider ID or cloud-storage URI like s3:// or gs://) are forwarded without any validation. The root cause is the inconsistent validation logic: while URL-based file parts are checked, UploadedFile references bypass this protection. An unauthenticated attacker can submit crafted message history containing an arbitrary UploadedFile reference; the model provider then resolves this reference using the server's IAM role, service account, or API key rather than the client's identity, allowing the server to fetch files from its own cloud account or other tenants. Exploitation requires knowledge of a valid file identifier, but depending on naming schemes, such identifiers may be guessable. Patches are available in pydantic-ai 1.106.0 (1.x) and 2.0.0b6 (2.x beta), which add the same validation for UploadedFile references as for URLs.
Affected products
- Pydantic pydantic-ai >=1.65.0, <1.106.0 or >=2.0.0b1, <2.0.0b6
- Pydantic pydantic-ai-slim >=1.65.0, <1.106.0 or >=2.0.0b1, <2.0.0b6
Timeline
- 2026-06-10: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-10: patched: Patches released: pydantic-ai 1.106.0 (1.x) and 2.0.0b6 (2.x beta)
- 2026-08-13: advisory: Advisory GHSA-h7p7-w5gc-xj3w published with CVE-2026-54249