CVE-2026-46678: CWE-918: Server-Side Request Forgery (SSRF) in pydantic pydantic-ai
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.
AI Analysis
Technical Summary
Pydantic AI versions 1.56.0 through 1.98.0 contain an SSRF vulnerability (CWE-918) when an application opts a URL into force_download='allow-local', disabling the default block on private/internal IPs. This allows attackers to bypass the cloud-metadata IP blocklist by encoding the metadata IP in IPv6 transition forms such as IPv4-mapped IPv6, 6to4, or NAT64. As a result, cloud IAM short-term credentials may be exposed on dual-stack or translated networks. This vulnerability is a bypass of the previous fix for CVE-2026-25580, which did not account for IPv6-encoded metadata IPs. Only applications explicitly opting into this setting on URLs influenced by untrusted input are affected. Bundled integrations and developer-controlled URLs are not vulnerable. The issue has been fixed in pydantic-ai version 1.99.0.
Potential Impact
An attacker can exploit this SSRF vulnerability to bypass cloud metadata IP blocklists and potentially retrieve cloud IAM short-term credentials. This exposure could lead to unauthorized access to cloud resources. The vulnerability requires specific application configuration (force_download='allow-local' on untrusted URLs) and does not affect default or typical usage. There is no indication of known exploits in the wild.
Mitigation Recommendations
A fix is available in pydantic-ai version 1.99.0. Users should upgrade to version 1.99.0 or later to remediate this vulnerability. Applications should avoid setting force_download='allow-local' on URLs influenced by untrusted input. Bundled integrations and developer-controlled URL usage are not affected and require no action.
CVE-2026-46678: CWE-918: Server-Side Request Forgery (SSRF) in pydantic pydantic-ai
Description
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.
CVSS v3.1
Score 6.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Pydantic AI versions 1.56.0 through 1.98.0 contain an SSRF vulnerability (CWE-918) when an application opts a URL into force_download='allow-local', disabling the default block on private/internal IPs. This allows attackers to bypass the cloud-metadata IP blocklist by encoding the metadata IP in IPv6 transition forms such as IPv4-mapped IPv6, 6to4, or NAT64. As a result, cloud IAM short-term credentials may be exposed on dual-stack or translated networks. This vulnerability is a bypass of the previous fix for CVE-2026-25580, which did not account for IPv6-encoded metadata IPs. Only applications explicitly opting into this setting on URLs influenced by untrusted input are affected. Bundled integrations and developer-controlled URLs are not vulnerable. The issue has been fixed in pydantic-ai version 1.99.0.
Potential Impact
An attacker can exploit this SSRF vulnerability to bypass cloud metadata IP blocklists and potentially retrieve cloud IAM short-term credentials. This exposure could lead to unauthorized access to cloud resources. The vulnerability requires specific application configuration (force_download='allow-local' on untrusted URLs) and does not affect default or typical usage. There is no indication of known exploits in the wild.
Mitigation Recommendations
A fix is available in pydantic-ai version 1.99.0. Users should upgrade to version 1.99.0 or later to remediate this vulnerability. Applications should avoid setting force_download='allow-local' on URLs influenced by untrusted input. Bundled integrations and developer-controlled URL usage are not affected and require no action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-15T21:46:51.547Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6a61149c2644c7f8ff97db
Added to database: 07/29/2026, 20:22:44 UTC
Last enriched: 07/29/2026, 20:39:02 UTC
Last updated: 07/29/2026, 21:07:49 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.