CVE-2026-48782: 
PydanticAI vulnerability analysis and mitigation

CVE-2026-48782 is an SSRF cloud-metadata blocklist bypass vulnerability in Pydantic AI (a Python agent framework for building Generative AI applications) that allows attackers to access cloud IAM short-term credentials by encoding metadata endpoint IPs in IPv6 transition forms not decoded by the prior fix. It affects pydantic-ai and pydantic-ai-slim versions >= 1.56.0 and < 1.102.0, as well as 2.0.0b1 and 2.0.0b2. The vulnerability was published on June 17, 2026, and represents an incomplete fix of CVE-2026-46678 (itself a follow-up to CVE-2026-25580). It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an authentication bypass via alternate name (CWE-289) and Server-Side Request Forgery (CWE-918): the _normalize_ip / is_cloud_metadata_ip function in pydantic_ai/_ssrf.py only decoded IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix (64:ff9b::/96), leaving several IPv6 transition forms unhandled. An attacker can supply a URL containing the cloud metadata IP (169.254.169.254, etc.) encoded as IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, or ISATAP (...:[0|200]:5efe:a.b.c.d); the IPv6 wrapper passes the blocklist check and is then routed by the underlying network to the IPv4 metadata endpoint. Exploitation requires two preconditions: (1) the application explicitly opts a FileUrl into force_download='allow-local' on a URL influenced by untrusted input, and (2) the deployment network actually routes the affected transition forms — NAT64-configured networks (IPv6-only or dual-stack-with-NAT64, including some Kubernetes setups) or networks with an ISATAP tunnel (GitHub Advisory, Fix PR #5596).

Successful exploitation exposes cloud IAM short-term credentials retrieved from instance metadata services (e.g., AWS IMDS at 169.254.169.254, Azure WireServer at 168.63.129.16, Alibaba Cloud at 100.100.100.200, and others). These credentials can be used for lateral movement within the cloud environment, privilege escalation, or unauthorized access to cloud resources and data stores. There is no integrity or availability impact — the vulnerability is purely a confidentiality breach with a changed scope, as the affected component (the AI framework) exposes credentials belonging to the underlying cloud infrastructure (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (Feedly). CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable with partial technical impact. The EPSS score is approximately 0.33% (0.003320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The narrow attack surface — requiring force_download='allow-local' on attacker-influenced URLs on NAT64/ISATAP networks — significantly limits practical exploitability (Red Hat CVE).

1. Identify a vulnerable target: Locate an application using pydantic-ai or pydantic-ai-slim versions 1.56.0–1.101.0 (or 2.0.0b1/2.0.0b2) that accepts user-controlled URLs and passes them with force_download='allow-local' to a FileUrl type (e.g., ImageUrl, AudioUrl).
2. Confirm network routing: Verify the target deployment runs on a NAT64-configured network (IPv6-only or dual-stack-with-NAT64, such as certain Kubernetes clusters) or a network with an ISATAP tunnel, so that the IPv6 transition forms are actually routed to the underlying IPv4 endpoint.
3. Craft a bypass URL: Encode the cloud metadata IP in an IPv6 transition form not blocked by the prior fix. Examples include:
   • IPv4-compatible: http://[::169.254.169.254]/latest/meta-data/
   • NAT64 RFC 8215 local-use prefix: http://[64:ff9b:1::169.254.169.254]/latest/meta-data/
   • ISATAP (with a public prefix): http://[2606:4700::5efe:169.254.169.254]/latest/meta-data/
   • Operator-chosen NAT64 prefix: http://[2001:db8:64::a9fe:a9fe]/latest/meta-data/
4. Submit the crafted URL: Supply the malicious URL as input to the vulnerable application endpoint that processes it with force_download='allow-local'.
5. Retrieve credentials: The IPv6-wrapped request bypasses the blocklist, is routed by the NAT64/ISATAP network to 169.254.169.254 (or another metadata endpoint), and the response — containing cloud IAM short-term credentials — is returned to the attacker (GitHub Advisory, Fix PR #5596).

• Network: Outbound HTTP requests from the application to IPv6 addresses encoding 169.254.169.254 or other metadata IPs (e.g., [::169.254.169.254], [64:ff9b:1::169.254.169.254], [2606:4700::5efe:169.254.169.254]); unexpected HTTP GET requests to cloud metadata endpoints (/latest/meta-data/, /computeMetadata/v1/, etc.) originating from the AI application process.
• Logs: Application logs showing URL validation passing for IPv6-encoded metadata addresses; HTTP access logs on the metadata service recording requests from the application's IP with unusual User-Agent strings or at unexpected times.
• Process/Behavior: Unusual credential usage in cloud provider audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Log) shortly after metadata endpoint access — particularly short-lived IAM credentials being used from unexpected source IPs or regions.

Upgrade to pydantic-ai or pydantic-ai-slim version 1.102.0 or later (stable line), or 2.0.0b3 or later (2.0 pre-release line). The fix in PR #5596 expands the _embedded_ipv4s() helper to decode all standardized IPv6 transition forms — IPv4-mapped, IPv4-compatible, 6to4, NAT64 across all RFC 6052 prefix lengths (including RFC 8215 local-use and operator-chosen prefixes), ISATAP, and Teredo — before evaluating blocklist membership, and also expands the set of blocked cloud metadata endpoints (GitHub Release v1.102.0). As a workaround for unpatched versions, avoid passing force_download='allow-local' on any URL that could be influenced by untrusted input; if unavoidable, resolve the hostname independently and validate the result against a comprehensive metadata blocklist including all IPv6 transition forms before constructing the FileUrl. Additionally, apply network-level firewall rules to block application instances from reaching cloud metadata endpoints (GitHub Advisory).

The vulnerability was reported by security researcher @SnailSploit and found by @0xShemesh, and was fixed by Pydantic maintainer @DouweM in PR #5596 merged on May 23, 2026. The fix was described as "a tight, well-scoped security fix" by the automated review bot, which verified correctness of RFC 6052 offset arithmetic, ISATAP marker detection, and Teredo XOR decoding. The advisory notes this is the third in a chain of incomplete SSRF fixes (following CVE-2026-25580 and CVE-2026-46678), reflecting the complexity of comprehensively blocking all IPv6 transition forms (GitHub Advisory, Fix PR #5596).