CVE-2026-54249 in pydantic-ai
Summary
by MITRE • 07/29/2026
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within Pydantic AI framework versions 1.65.0 through 1.105.0 and 2.0.0b1 through 2.0.0b5, representing a critical access control flaw that enables unauthorized file access across cloud storage accounts. The vulnerability stems from insufficient validation of UploadedFile references within the UI adapter component, particularly when processing message history submitted by clients. While the framework properly validates URL schemes against an allowlist, it fails to validate the actual file references that point to cloud storage identifiers such as s3:// or gs:// paths. This design flaw creates a server-side identity misalignment where the system resolves file references using its own authentication context rather than the client's permissions, effectively allowing attackers to access files within the same account or potentially other tenant accounts.
The technical implementation of this vulnerability involves the use of UploadedFile objects that contain references to cloud storage identifiers without proper validation. When clients submit message history containing these references, the system forwards them directly to the cloud provider without additional verification steps. This creates a privilege escalation scenario where an attacker with knowledge of valid file identifiers can craft malicious requests that leverage the server's own credentials to access resources they would not normally be able to reach. The vulnerability is particularly dangerous because it exploits the trust relationship between the application and its cloud providers, allowing for lateral movement within cloud storage environments.
The operational impact of this vulnerability extends beyond simple unauthorized data access, as it can enable attackers to potentially exfiltrate sensitive information from cloud storage accounts that are not directly exposed to external clients. The exploit requires only a valid file identifier, which may be guessable or enumerable depending on how applications name their objects within cloud storage systems. This makes the vulnerability particularly attractive to threat actors who can perform reconnaissance to identify accessible files through techniques such as directory traversal or enumeration attacks. The issue affects not just individual applications but potentially entire multi-tenant environments where different users or applications share the same cloud account infrastructure.
Security mitigations for this vulnerability include upgrading to versions 1.106.0 and 2.0.0b6, which implement proper validation of UploadedFile references before forwarding them to cloud storage providers. Organizations should also implement additional controls such as validating all file references against known good patterns, implementing stricter access controls for cloud storage identifiers, and monitoring for unusual file access patterns within their cloud environments. This vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques involving privilege escalation and data exfiltration through cloud resources. The fix demonstrates the importance of proper input validation and maintaining consistent authentication contexts when interacting with external systems, particularly in multi-tenant or shared infrastructure environments where identity separation is critical for security isolation.