CVE-2026-107288 in Pydantic-AI
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python agent framework designed to facilitate the construction of applications and workflows leveraging Generative Artificial Intelligence capabilities. Within this ecosystem, tools such as local web_fetch_tool and WebFetch are utilized to enable agents to retrieve external resources via HTTP requests. These tools incorporate security mechanisms intended to restrict access to specific domains or IP ranges, thereby preventing unauthorized data exfiltration or interaction with internal infrastructure. The vulnerability identified in versions 1.77.0 through 1.107.6 and version 2.44.0 stems from a flaw in the domain validation logic employed by these fetching mechanisms. Specifically, the comparison between blocked domains entries and the target URL hostname occurs before both values are normalized into the canonical form expected by the underlying network resolution functions like getaddrinfo. This sequencing error creates an opportunity for bypassing security controls through encoding variations that result in identical network destinations but distinct string representations.
The core technical flaw lies in the lack of normalization prior to domain comparison. An attacker who can influence or manipulate the model's output, which dictates the URLs fetched by the agent, can exploit this discrepancy. By utilizing equivalent Internationalized Domain Name IDNA spellings, non-ASCII label separators, case variations that are not handled uniformly before resolution, or trailing root labels, an adversary can craft a URL string that differs from the blocked domain entry in its textual representation yet resolves to the same IP address or host. Because the security check compares the raw input against the blocklist without first converting both to their resolved forms, the system fails to recognize the equivalence. Consequently, the application proceeds to fetch the resource using its own privileges, effectively bypassing the intended restrictions on blocked domains.
This vulnerability is classified under CWE-20 Improper Input Validation and aligns with ATT&CK technique T1583 Acquire Infrastructure, as it allows an attacker to indirectly access resources that should be prohibited. The operational impact involves potential unauthorized data retrieval or interaction with sensitive internal services if those targets were part of the blocked list but could be reached via these encoding tricks. It is important to note that while domain blocking can be bypassed through this method, other security controls such as allowed_domains lists operate on a fail-closed basis for unmatched spellings, and protections against accessing private IP addresses or cloud metadata endpoints remain effective due to separate validation logic that likely handles normalization correctly. This partial mitigation limits the scope of exploitation but does not eliminate the risk entirely if blocked domains are relied upon as the primary defense mechanism.
To mitigate this vulnerability, organizations using Pydantic AI must upgrade to version 1.107.6 or later for the legacy branch and version 2.44.0 or later for the current release line. These updated versions address the normalization issue by ensuring that domain names are processed consistently before comparison against security policies. Developers should also review their agent configurations to ensure that critical data fetching operations rely on robust allow-listing strategies rather than solely on block lists, as allow-lists generally provide a more secure posture when implemented correctly with proper input validation and normalization at the earliest possible stage in the request lifecycle.