CVE-2026-46678: 
PydanticAI vulnerability analysis and mitigation

CVE-2026-46678 is a Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI, a Python agent framework for building Generative AI applications. It represents an incomplete fix of CVE-2026-25580 (GHSA-2jrp-274c-jhv3), where the cloud-metadata blocklist could be bypassed by encoding metadata IP addresses in IPv6 transition forms (IPv4-mapped IPv6, 6to4, or NAT64). Affected versions span 1.56.0 through 1.98.0 of both pydantic-ai and pydantic-ai-slim; the issue was disclosed on May 20–21, 2026, and patched in version 1.99.0. The CVSS v3.1 base score is 6.8 (Medium) per the GitHub Advisory, though NVD records a score of 5.9 (Medium) (Github Advisory, Pydantic Security Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), where the URL validation logic in Pydantic AI's file download mechanism failed to normalize IPv6 transition address forms before applying the cloud-metadata blocklist. When an application explicitly sets force_download='allow-local' on a FileUrl type (e.g., ImageUrl, AudioUrl, VideoUrl, DocumentUrl) with a URL influenced by untrusted input, an attacker can supply a URL using IPv4-mapped IPv6 (e.g., ::ffff:169.254.169.254), 6to4, or NAT64 encoding of a blocked metadata IP. On dual-stack or translated networks, the underlying network stack routes the IPv6-wrapped address to the actual IPv4 cloud metadata endpoint (such as 169.254.169.254), bypassing the blocklist entirely. The bypass was introduced alongside the original SSRF protection in version 1.56.0, meaning the vulnerability existed from the moment the fix for CVE-2026-25580 was shipped (Github Advisory, Pydantic Security Advisory).

Successful exploitation exposes cloud IAM short-term credentials by allowing an attacker to cause the server to fetch the cloud instance metadata endpoint (e.g., AWS IMDSv1 at 169.254.169.254). This is a confidentiality-only impact — integrity and availability are not affected — but leaked IAM credentials can enable significant lateral movement within a cloud environment, including privilege escalation, data exfiltration, or resource abuse. The scope is marked as Changed in the CVSS scoring, reflecting that the impact extends beyond the vulnerable Pydantic AI component to the broader cloud infrastructure (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity requirement — exploitation requires the target application to have explicitly opted into force_download='allow-local' on a URL influenced by untrusted input, which is a non-default configuration. The EPSS score is approximately 0.039%–0.419% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher j0hndo (Github Advisory, Pydantic Security Advisory).

1. Identify a vulnerable application: Find an application using pydantic-ai or pydantic-ai-slim versions 1.56.0–1.98.0 that explicitly passes force_download='allow-local' on a FileUrl type (e.g., ImageUrl, AudioUrl) where the URL value is influenced by untrusted user input.
2. Craft an IPv6-encoded metadata URL: Construct a URL targeting the cloud metadata endpoint using an IPv6 transition form to bypass the blocklist. For example, encode 169.254.169.254 (AWS IMDS) as an IPv4-mapped IPv6 address: http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/ or use a 6to4 or NAT64 representation.
3. Submit the malicious URL: Supply the crafted URL as the value for the file URL field in the application (e.g., as an image URL in a request), ensuring it is processed with the force_download='allow-local' setting.
4. Trigger server-side fetch: The application's Pydantic AI URL validation passes the IPv6-encoded address (blocklist check fails to match it against the blocked IPv4 range), and the server fetches the URL. On a dual-stack or NAT64-translated network, the request is routed to the actual 169.254.169.254 metadata endpoint.
5. Retrieve cloud IAM credentials: The metadata service responds with short-term IAM credentials (e.g., AWS access key, secret key, session token), which are returned to or accessible by the attacker, enabling further cloud infrastructure access (Github Advisory, Pydantic Security Advisory).

• Network: Outbound HTTP requests from the application server to 169.254.169.254 or its IPv6-encoded equivalents (e.g., ::ffff:169.254.169.254, 2002:a9fe:a9fe::, NAT64 prefix 64:ff9b::169.254.169.254) targeting paths such as /latest/meta-data/iam/security-credentials/.
• Network: Unexpected connections to cloud metadata endpoints for other providers (e.g., 169.254.169.254 for Azure/GCP, fd00:ec2::254 for AWS IMDSv2) originating from the Pydantic AI application process.
• Logs: Application logs showing FileUrl or related URL download requests containing IPv6-encoded addresses in bracket notation (e.g., [::ffff:a9fe:a9fe]) or 6to4/NAT64 prefixes.
• Logs: Cloud provider access logs (e.g., AWS CloudTrail) showing IAM credential usage from unexpected IP addresses or regions shortly after a metadata endpoint was accessed.
• File System / Process: Unexpected use of newly issued short-term IAM credentials (identifiable by the AssumedRole or GetSessionToken session tokens) in cloud API calls not consistent with normal application behavior.

Upgrade pydantic-ai or pydantic-ai-slim to version 1.99.0 or later, which normalizes IPv6 transition forms (IPv4-mapped IPv6, 6to4, NAT64) before applying the cloud-metadata and private-IP blocklists, and extends coverage to additional IANA-reserved ranges (Pydantic Release). For applications that cannot immediately upgrade, the recommended workaround is to avoid passing force_download='allow-local' on any URL that could be influenced by untrusted input. If allow-local is strictly required, developers should resolve the hostname server-side and validate the resolved IP against a comprehensive metadata blocklist — including all IPv6 transition forms — before constructing the FileUrl object (Github Advisory). Applications using bundled integrations (Agent.to_web, VercelAIAdapter, AGUIAdapter) are not affected and require no action.

The vulnerability was reported by security researcher j0hndo and published by Pydantic maintainer DouweM on May 20, 2026. Red Hat tracked the issue via Bugzilla (Bug 2508674) and classified it as medium severity. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database entries and security scanner updates from vendors such as Tenable (Red Hat Bugzilla, Github Advisory).