Pydantic AI versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2 contain an SSRF vulnerability where the cloud-metadata IP blocklist can be bypassed by encoding the metadata IP in IPv6 transition forms not handled by the prior fix (CVE-2026-46678). These forms include IPv4-compatible IPv6 (::a.b.c.d), NAT64 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP. When an application using pydantic-ai enables force_download='allow-local', disabling the default block on private/internal IPs, and runs on networks routing these IPv6 forms (e.g., NAT64-configured or ISATAP tunnel networks), the IPv6 wrapper is delivered to the IPv4 metadata endpoint, exposing cloud IAM short-term credentials. Standard dual-stack cloud VMs or containers not routing these forms are not affected in practice. The vulnerability is an incomplete fix of a previous SSRF issue and has been addressed in version 2.0.0b3.

Successful exploitation can expose cloud IAM short-term credentials by bypassing the cloud-metadata IP blocklist via SSRF. This can lead to unauthorized access to cloud resources. The vulnerability requires network conditions that route specific IPv6 transition forms and the application to opt into allowing local URL downloads, limiting the practical attack surface.

A fix is available in pydantic-ai version 2.0.0b3. Users should upgrade to this version to remediate the vulnerability. No official remediation level is stated, but the vendor has addressed the issue in the specified version. Until upgrading, avoid enabling force_download='allow-local' on networks routing the affected IPv6 transition forms.