Pydantic AI up to 2.0.0b0/2.29.x Host Header Validation Agent.to_web dns rebinding

Summaryinfo

A vulnerability described as critical has been identified in Pydantic AI up to 2.0.0b0/2.29.x. The affected element is the function Agent.to_web of the component Host Header Validation. The manipulation of the argument Host results in dns rebinding. This vulnerability is identified as CVE-2026-107292. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Pydantic AI up to 2.0.0b0/2.29.x. Affected is the function Agent.to_web of the component Host Header Validation. The manipulation of the argument Host with an unknown input leads to a dns rebinding vulnerability. CWE is classifying the issue as CWE-350. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-107292 since 10/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1583.002.

Upgrading to version 1.107.5 or 2.30.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Pydantic

Name

• AI

Version

• 2.0
• 2.0.0b0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion