CVE-2026-107289 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python agent framework designed to facilitate the construction of applications and workflows leveraging Generative Artificial Intelligence capabilities. Within this ecosystem, developers can configure tools that allow agents to interact with external resources, including web fetching functionalities. A critical security flaw was identified in versions ranging from 1.56.0 up to 1.107.6 for the major version one branch, and up to 2.44.0 for the major version two branch. This vulnerability specifically affects configurations where developers explicitly opt into allowing local network access through specific parameters such as FileUrl with force_download set to allow-local or web_fetch_tool configured with allow_local_urls enabled to True. These settings are disabled by default, meaning that only applications with deliberate configuration choices exposing their agents to local network resources are susceptible to this issue.
The core technical flaw resides in the handling of IPv6 addresses within the cloud-metadata blocklist mechanism intended to prevent access to sensitive internal services like metadata endpoints. The vulnerability exploits a discrepancy between how Python's IPv6Address class handles equality and hashing versus how the underlying operating system network stack processes these addresses during connection attempts. Specifically, when an attacker influences the URL provided to the agent, they can append an IPv6 zone identifier to an IPv6 metadata address. In Python, the inclusion of this zone identifier changes the string representation and hash value of the IP object. Consequently, the blocklist comparison logic fails because the modified address does not match the blocked entry in its original form. However, when the connection is actually established by the network stack, it ignores the zone identifier for non-link-local destinations and successfully routes the request to the metadata service.
This discrepancy results in a security bypass where the application believes it has validated the URL against safe or allowed lists, while simultaneously allowing access to restricted internal resources. The operational impact of this vulnerability is severe, as cloud metadata services often contain sensitive information such as Instance Metadata Service data which includes Cloud IAM credentials and other authentication tokens. If an attacker can manipulate the input fed into a Pydantic AI agent with local network access enabled, they may extract these credentials, leading to potential unauthorized access, privilege escalation, or further compromise of the underlying infrastructure. The exploit relies on the target environment supporting IPv6 connectivity, which is increasingly common in modern cloud deployments but not universal.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or API, as it involves failing to properly validate input against security controls due to implementation-specific behavior differences. In the context of the MITRE ATT&CK framework, this technique relates to T1530 Data from Cloud Storage Object Discovery and potentially T1602 Network Service Scanning if used for broader reconnaissance, though its primary utility here is credential theft via metadata access. The issue highlights the risks associated with relying on high-level language abstractions that may not perfectly mirror low-level network behavior without explicit normalization or canonicalization of inputs before security checks are performed.
Mitigation strategies primarily involve upgrading to patched versions where this logic has been corrected to ensure consistent handling of zone identifiers during validation and actual connection phases. For environments unable to upgrade immediately, administrators should review configurations involving web_fetch_tool and FileUrl settings. It is critical to disable allow_local_urls or force_download options unless absolutely necessary for the application's function. Additionally, implementing network-level controls such as firewall rules that restrict outbound connections from agent containers or virtual machines to known metadata IP ranges can provide a defense-in-depth layer. Security teams should also audit existing Pydantic AI deployments for any opt-in configurations that expose local network access and ensure that input validation logic accounts for all variations of address representation, including zone identifiers in IPv6 contexts.