Pydantic AI, a Python framework for Generative AI applications, contains an SSRF vulnerability (CVE-2026-46678) in versions >=1.56.0 and <1.99.0. When an application explicitly sets force_download='allow-local' on a FileUrl-type parameter derived from untrusted input, the cloud-metadata IP blocklist can be bypassed by encoding the metadata IP in IPv6 transition formats such as IPv4-mapped IPv6, 6to4, or NAT64. This bypass exposes cloud IAM short-term credentials on networks supporting dual-stack or address translation. The vulnerability is an incomplete fix of CVE-2026-25580, which did not account for IPv6-encoded metadata IPs. Bundled integrations that do not propagate force_download from external data or that download only from developer-controlled URLs are not affected. The issue is resolved in pydantic-ai version 1.99.0.

Successful exploitation can lead to exposure of cloud IAM short-term credentials by bypassing the cloud-metadata IP blocklist through SSRF attacks using IPv6-encoded metadata IP addresses. This could allow an attacker to access sensitive cloud metadata services, potentially compromising cloud resource security. The vulnerability requires that the application explicitly opts into force_download='allow-local' on URLs influenced by untrusted input, limiting the scope of impact.

Upgrade pydantic-ai to version 1.99.0 or later, where this vulnerability is fixed. Applications that do not explicitly enable force_download='allow-local' on URLs influenced by untrusted input are not affected. Bundled integrations that do not propagate force_download from external data or only download from developer-controlled URLs are also not vulnerable. Review application configurations to avoid enabling force_download='allow-local' on untrusted URLs.