CVE-2026-107292 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified within Pydantic AI affects agent frameworks operating between version 1.34.0 and 2.30.0, specifically impacting the Agent.to_web() method and the clai web development chat server functionality. This security flaw stems from a critical failure in HTTP header validation, where the application does not adequately verify or restrict the Host header provided by incoming requests. In standard web application architecture, the Host header is essential for virtual hosting and routing traffic to the correct service instance on servers that host multiple domains. However, when this header is accepted without rigorous validation against a whitelist of expected local addresses, it creates an opening for DNS rebinding attacks. This type of attack exploits the trust relationship between browsers and web servers by manipulating Domain Name System resolution during the lifetime of a connection, allowing an attacker to bypass same-origin policies that would normally prevent cross-site interactions.
The operational impact of this vulnerability is severe because it effectively neutralizes several standard security controls designed to protect local services from external access. Typically, binding a service exclusively to localhost or 127.0.0.1 is considered a robust defense against remote exploitation, as network traffic intended for loopback addresses should not originate from the public internet. Similarly, developers often rely on Origin header checks and Cross-Site Request Forgery tokens to prevent unauthorized actions initiated by malicious websites. However, DNS rebinding circumvents these measures because the browser perceives the request as originating from a same-origin source after the domain resolution has been switched to point at the local loopback address. Consequently, any website visited by a developer can initiate requests that appear legitimate to the Pydantic AI server, treating them as if they were generated by trusted internal applications or scripts running on the same machine.
This lack of validation allows hostile web pages to read sensitive user interface data served by the agent and submit chat requests that execute agent tools with the privileges and credentials of the local process. Since these agents often have access to local files, APIs, databases, or other system resources necessary for their workflow automation tasks, an attacker can leverage this trust boundary violation to perform unauthorized actions. The consequences include significant data disclosure where sensitive information processed by the AI is exfiltrated, as well as unwanted side effects such as modification of local files, execution of arbitrary commands, or disruption of ongoing development workflows. This represents a classic case of insecure direct object references combined with insufficient validation of user-supplied input, leading to potential compromise of the developer's entire workstation environment through the browser interface alone.
From an industry standards perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-346 Origin Validation Error. The failure to validate the Host header is a specific instance of these broader categories where the application accepts input that determines resource access without ensuring it matches expected constraints. In terms of attack tactics, this scenario maps directly to MITRE ATT&CK technique T1078 Valid Accounts if credentials are stolen via data disclosure, but more accurately reflects techniques related to client-side evasion and browser-based attacks such as DNS Rebinding (T1564) which is often used in conjunction with Cross-Site Request Forgery patterns. The exploitation path demonstrates how local services exposed through web interfaces can become attack vectors for remote code execution or privilege escalation if proper network-level and application-layer controls are not enforced.
To mitigate this vulnerability, users must upgrade to the fixed versions of Pydantic AI, specifically version 1.107.5 or any release from the 2.x series starting with 2.30.0. These updates implement strict validation logic for incoming Host headers, ensuring that only requests originating from explicitly trusted local addresses are processed by the agent interface. For organizations still operating on older versions where immediate patching is not feasible, temporary mitigations include restricting network access to the development server using firewall rules or reverse proxy configurations that enforce host header checks at a lower level than the application itself. Additionally, developers should avoid exposing these web interfaces to untrusted networks and consider implementing additional security headers such as Strict-Transport-Security if HTTPS is utilized, although this does not fully resolve the DNS rebinding issue without proper server-side validation of the Host or Origin fields against an allowlist of expected local domains.