CVE-2026-25580: 
PydanticAI vulnerability analysis and mitigation

CVE-2026-25580 is a Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI's URL download functionality (download_item() helper). It affects pydantic-ai and pydantic-ai-slim versions >= 0.0.26 and < 1.56.0. When applications accept message history from untrusted sources, attackers can inject malicious URLs that cause the server to make HTTP requests to internal network resources, including cloud metadata endpoints. Disclosed on February 6, 2026, it carries a CVSS v3.1 base score of 8.6 (High) (Github Advisory, Pydantic Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the download_item() function fetches content from user-supplied URLs without validating whether the target is a public internet address. Attackers who can inject message history (via ImageUrl, AudioUrl, VideoUrl, or DocumentUrl objects) can direct the server to request loopback addresses (127.0.0.1), private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x), or cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254. The vulnerability is exploitable with no authentication or user interaction required, and affects multiple model integrations including OpenAIChatModel, AnthropicModel, GoogleModel, XaiModel, BedrockConverseModel, and OpenRouterModel. Applications exposed only to developer-controlled URLs are not affected (Pydantic Advisory, Github Advisory).

Successful exploitation allows unauthenticated remote attackers to cause the server to make arbitrary HTTP requests to internal network resources, enabling unauthorized access to internal services, internal network enumeration, and theft of cloud credentials (e.g., AWS IAM role credentials via the EC2 Instance Metadata Service). The scope change (CVSS S:C) reflects that the impact extends beyond the vulnerable component to internal infrastructure and cloud environments. Integrity and availability are not directly impacted, but credential theft could enable full account takeover and lateral movement across cloud environments (Pydantic Advisory, Github Advisory).

No confirmed in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.011% (0.019% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood. A proof-of-concept attack scenario is publicly documented in the official security advisory, though no weaponized exploit code has been confirmed. The vulnerability is not listed in the CISA KEV catalog. Attack complexity is low and no privileges or user interaction are required, making exploitation straightforward for any attacker who can submit message history to a vulnerable application (Github Advisory, Pydantic Advisory).

1. Identify a vulnerable target: Locate a web application using Pydantic AI versions 0.0.26–1.55.x that exposes a chat interface or API accepting message history from external users (e.g., via Agent.to_web, VercelAIAdapter, AGUIAdapter, or a custom API endpoint).
2. Craft a malicious message payload: Construct a JSON message history payload containing a URL part pointing to an internal resource or cloud metadata endpoint:

{
  "role": "user",
  "parts": [
    {"type": "file", "mediaType": "image/png", "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}
  ]
}

3. Submit the payload: Send the crafted message history to the vulnerable application endpoint via HTTP POST or through the chat interface.
4. Trigger server-side fetch: The server's download_item() function processes the URL without validation and makes an HTTP GET request to the specified internal address.
5. Retrieve sensitive data: The server returns the response content (e.g., AWS IAM role credentials, internal service data) to the attacker, either directly in the API response or indirectly through application behavior.
6. Escalate access: Use harvested cloud credentials to authenticate to cloud APIs and perform lateral movement or privilege escalation within the cloud environment (Pydantic Advisory, Github Advisory).

• Network: Outbound HTTP requests from the application server to 169.254.169.254, 100.100.100.200, fd00:ec2::254, 127.0.0.1, or RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from the Pydantic AI process.
• Network: Unexpected HTTP GET requests to cloud metadata paths such as /latest/meta-data/iam/security-credentials/ or /computeMetadata/v1/ from the application server.
• Logs: Application or web server logs showing message history submissions containing ImageUrl, AudioUrl, VideoUrl, or DocumentUrl objects with internal or link-local IP addresses as URL values.
• Logs: HTTP client logs (e.g., httpx) recording requests to private IP ranges or metadata endpoints initiated by the download_item() function.
• File System / Process: Unexpected use of cloud credentials (e.g., AWS API calls using short-lived IAM role tokens) from IP addresses not associated with the cloud instance, indicating credential theft and reuse.

Upgrade pydantic-ai and pydantic-ai-slim to version 1.56.0 or later, which introduces a new _ssrf.py module providing protocol validation (HTTP/HTTPS only), pre-request DNS resolution to prevent DNS rebinding, blocking of all private/internal IP ranges by default, and permanent blocking of cloud metadata endpoints regardless of configuration (Pydantic Advisory, Patch Commit). If immediate upgrade is not possible, implement a history_processors filter that resolves hostnames and blocks URLs targeting private, loopback, or link-local addresses before they are processed by the agent. Applications that do not accept message history from untrusted external users are not affected and require no action.

The vulnerability was reported by security researchers YuvalElbar6 and doredry and published by Pydantic maintainer DouweM on February 6, 2026 (Pydantic Advisory). A blog post from April 2026 discussed SSRF risks in AI agent frameworks including this vulnerability in the context of browser-use agents (Security Horror Blog). Community attention was noted via social media, with coverage on threat intelligence aggregators shortly after disclosure.