CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Attackers can bypass cloud metadata blocklists in Pydantic AI via IPv6 zone identifiers to steal IAM credentials when local URL fetching is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107289?
CVE-2026-107289 is a medium-severity server-side request forgery vulnerability in pydantic-ai, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
Which versions are affected by CVE-2026-107289?
10 open source packages ship an affected version, including pydantic-ai and pydantic-ai-slim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pydantic-ai PyPI | From 1.56.0 | 1.107.6, 2.44.0 |
pydantic-ai PyPI | From 1.56.0 | 1.107.6 |
pydantic-ai PyPI | From 1.56.0 | 1.107.6 |
pydantic-ai PyPI | From 2.0.0b1 | 2.44.0 |
pydantic-ai PyPI | From 2.0.0b1 | 2.44.0 |
pydantic-ai-slim PyPI | From 1.56.0 | 1.107.6, 2.44.0 |
4 more packages
pydantic-ai-slim PyPI | From 1.56.0 | 1.107.6 |
pydantic-ai-slim PyPI | From 1.56.0 | 1.107.6 |
pydantic-ai-slim PyPI | From 2.0.0b1 | 2.44.0 |
pydantic-ai-slim PyPI | From 2.0.0b1 | 2.44.0 |
Products include Pydantic Pydantic Ai.
How do I fix CVE-2026-107289?
Upgrade pydantic-ai to a fixed version for your release line: 1.107.6 or 2.44.0.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-107289 being exploited?
There is no known exploitation of CVE-2026-107289 in the wild and no public exploit code.
Other vulnerabilities in pydantic-ai
- CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
- CVE-2026-107295 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
- CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
- CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Sources
Also known as CLEANSTART-2026-OZ89271, GHSA-vmxc-h2x2-jmf3, PYSEC-2026-4282, PYSEC-2026-4291.