CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Attackers can bypass cloud metadata blocklists via IPv6 encoding to steal IAM credentials if developers explicitly enable local file downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46678?
CVE-2026-46678 is a medium-severity server-side request forgery vulnerability in pydantic-ai, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-46678?
6 open source packages ship an affected version, including pydantic-ai and pydantic-ai-slim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pydantic-ai PyPI | From 1.56.0 | 1.99.0 |
pydantic-ai PyPI | From 1.56.0 | 1.99.0 |
pydantic-ai PyPI | From 1.56.0 | 1.99.0 |
pydantic-ai-slim PyPI | From 1.56.0 | 1.99.0 |
pydantic-ai-slim PyPI | From 1.56.0 | 1.99.0 |
pydantic-ai-slim PyPI | From 1.56.0 | 1.99.0 |
Products include Pydantic Pydantic Ai.
How do I fix CVE-2026-46678?
Upgrade pydantic-ai to 1.99.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-46678 being exploited?
There is no known exploitation of CVE-2026-46678 in the wild and no public exploit code.
Other vulnerabilities in pydantic-ai
- CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
- CVE-2026-107295 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
- CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
- CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Sources
Also known as GHSA-cqp8-fcvh-x7r3, PYSEC-2026-2978, PYSEC-2026-2982, ROOT-APP-PYPI-CVE-2026-46678.