CVE-2026-65975 Missing authorization in pydantic-ai

Medium 6.5 Published 29 Jul 2026 Updated 30 Jul 2026

Remote clients can execute server tools with arbitrary arguments by exploiting a sanitization flaw, bypassing model-based guardrails in Pydantic AI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-65975?

CVE-2026-65975 is a medium-severity missing authorization vulnerability in pydantic-ai, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-65975?

It affects 1 product.

Products include Pydantic Pydantic Ai.

How do I fix CVE-2026-65975?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-65975 being exploited?

There is no known exploitation of CVE-2026-65975 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-DV71311, GHSA-jpr8-2v3g-wgf9.