CVE-2026-46678 in pydantic
Summary
by MITRE • 07/29/2026
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
Pydantic AI represents a Python-based framework designed for constructing generative artificial intelligence applications, and it incorporates functionality for handling various types of file downloads through URL-based mechanisms. The vulnerability under discussion affects versions ranging from 1.56.0 through 1.98.0 where the framework implements a security mechanism to prevent downloading files from private or internal IP addresses by default. However, when developers explicitly configure a URL to enable local downloads using force_download='allow-local', they inadvertently expose a bypass mechanism that can be exploited through IPv6 transition address formats.
The technical flaw exploits the incomplete nature of the previous fix for CVE-2026-25580 and GHSA-2jrp-274c-jhv3, which only addressed direct IPv4 representations of cloud metadata service IPs. The vulnerability allows attackers to encode these metadata IP addresses using IPv6 transition mechanisms including IPv4-mapped IPv6 addresses, 6to4 tunnels, or NAT64 translations. This encoding technique enables the bypass of the cloud-metadata blocklist that was intended to prevent access to internal cloud infrastructure, particularly targeting AWS EC2 metadata service endpoints which typically operate on private IPs such as 169.254.169.254.
The operational impact of this vulnerability is significant in environments where applications process untrusted input through URL parameters or external data sources. When an application accepts user-provided URLs and explicitly configures them for local download access, it creates a vector for credential exposure. The attack scenario becomes particularly dangerous on dual-stack networks or those utilizing network address translation that translates IPv4 metadata addresses into IPv6 forms. Cloud IAM short-term credentials could be inadvertently exposed to attackers who craft malicious URLs using these IPv6 transition encodings, potentially compromising cloud security boundaries.
This vulnerability aligns with CWE-20: Improper Input Validation and CWE-1035: OWASP Top Ten 2021 Category A03: Injection, as it represents an input validation weakness that allows bypass of intended security controls. From an ATT&CK framework perspective, this corresponds to T1566.001: Phishing with Malicious Attachment and T1071.004: Application Layer Protocol: DNS, since attackers could craft malicious URLs that appear legitimate but contain encoded internal addresses. The vulnerability also relates to T1595.002: Network Topology Discovery through the exploitation of network translation mechanisms.
The fix implemented in version 1.99.0 addresses this by ensuring comprehensive blocking of all forms of metadata service IP addresses regardless of their representation format, including IPv4-mapped IPv6 addresses and other transition encodings. Applications should be updated immediately to version 1.99.0 or later to prevent exploitation. Security practitioners should review codebases for explicit usage of force_download='allow-local' configuration, particularly when processing URLs from untrusted sources. The recommended mitigation involves avoiding the explicit enabling of local downloads for user-provided URLs while ensuring all network infrastructure properly handles IPv6 address translation and validation.
Organizations using Pydantic AI frameworks with affected versions should conduct immediate security assessments focusing on URL handling code paths that might enable force_download='allow-local' configurations. The vulnerability demonstrates the complexity of modern network security where traditional IPv4-based protections can be circumvented through sophisticated addressing schemes. This issue highlights the importance of comprehensive protocol-level validation rather than relying solely on address family detection, particularly in cloud-native environments where network translation and dual-stack support are common. The remediation emphasizes the need for robust security controls that account for all possible representations of potentially dangerous IP addresses across different networking protocols.
The vulnerability serves as a reminder of the challenges inherent in securing modern applications against sophisticated bypass techniques that exploit protocol-level features rather than application-level flaws. It demonstrates how seemingly benign configuration options can introduce significant security risks when combined with network translation mechanisms and underscores the importance of defense-in-depth approaches that validate inputs at multiple levels of abstraction. Security teams should implement monitoring for unusual download patterns and address family usage in their applications to detect potential exploitation attempts.