CVE-2026-54249: 
PydanticAI vulnerability analysis and mitigation

CVE-2026-54249 is a Server-Side Request Forgery (SSRF) / confused-deputy file disclosure vulnerability in Pydantic AI, a Python agent framework for building Generative AI applications. It affects pydantic-ai and pydantic-ai-slim versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5. The vulnerability was published on July 29, 2026, with patches released on June 4, 2026 (v1.106.0 and v2.0.0b6), and the security advisory (GHSA-h7p7-w5gc-xj3w) was formally published on August 13, 2026. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-918 (Server-Side Request Forgery): UI adapters such as the VercelAIAdapter reconstruct file parts from client-submitted message history and forward them to the model provider without sufficient validation. While file URL parts are validated against a scheme allowlist, UploadedFile references — which identify files by provider file ID or cloud-storage URI (e.g., s3://…, gs://…) — were forwarded to the model provider without any validation. Because the provider resolves UploadedFile references using the server's own identity (IAM role, service account, or API key) rather than the client's, an attacker who can submit crafted message history can cause the server to fetch arbitrary objects from its own cloud-storage account or other tenants' accounts. Exploitation requires knowledge of a valid file identifier, which may be guessable depending on how the application names objects (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to read arbitrary files from the application's model-provider or cloud-storage account (e.g., S3 buckets, GCS buckets) using the server's own privileged credentials. The confidentiality impact is high, as sensitive data stored in cloud storage or accessible via the model provider API key can be exfiltrated; there is no integrity or availability impact. In multi-tenant environments, cross-tenant data access is also possible if an attacker can reference another tenant's file identifiers, significantly expanding the blast radius (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). CISA's SSVC assessment classifies exploitation as "none" and the attack as not automatable, reflecting the requirement to obtain or guess a valid file identifier. The EPSS score is approximately 0.197%, indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify a target application: Locate a web application built with Pydantic AI (versions 1.65.0–1.105.0 or 2.0.0b1–2.0.0b5) that uses a UI adapter such as VercelAIAdapter and accepts client-submitted message history.
2. Obtain or guess a valid file identifier: Identify a cloud-storage URI (e.g., s3://bucket-name/path/to/file or gs://bucket/object) or a model-provider file ID that the server's IAM role or API key has access to. This may be possible through application behavior observation, predictable naming conventions, or prior knowledge of the target's storage layout.
3. Craft a malicious message history payload: Construct a message history JSON payload containing an UploadedFile reference pointing to the target file identifier (e.g., a crafted providerMetadata field with the attacker-chosen storage URI).
4. Submit the payload to the UI adapter endpoint: Send the crafted message history to the application's API endpoint that processes agent requests via the UI adapter (e.g., a Vercel AI SDK-compatible route).
5. Server fetches the file using its own credentials: The server's UI adapter forwards the unvalidated UploadedFile reference to the model provider, which resolves it using the server's IAM role, service account, or API key, returning the file contents.
6. Exfiltrate the response: The file contents are returned to the attacker as part of the model's response, enabling unauthorized data access (GitHub Advisory).

• Network: Unexpected outbound requests from the application server to cloud-storage endpoints (e.g., AWS S3, Google Cloud Storage) for objects not associated with legitimate user sessions; requests to model-provider APIs referencing file IDs not uploaded by the current user.
• Logs: Application or API gateway logs showing message history submissions containing UploadedFile references with s3://, gs://, or other cloud-storage URI schemes in the providerMetadata field; repeated requests with varying file identifiers suggesting enumeration attempts.
• Cloud Storage Access Logs: AWS CloudTrail or GCS audit logs recording GetObject or equivalent read operations on files not associated with normal application workflows, especially from the application's service account or IAM role at unusual times or for unusual objects.

Upgrade pydantic-ai or pydantic-ai-slim to version 1.106.0 (1.x line) or 2.0.0b6 (2.x beta line), which validate UploadedFile references in client-submitted messages the same way file URLs are validated (GitHub Release v1.106.0, GitHub Release v2.0.0b6). If upgrading immediately is not possible, do not pass untrusted client-submitted message history to the agent, or strip all UploadedFile parts from incoming messages before running the agent. Note that applications using AGUIAdapter / Agent.to_ag_ui with default settings are not affected, as the preserve_file_data flag that re-enables this path is off by default. Additionally, applying strict IAM policies and bucket-level access controls on cloud-storage accounts can limit the blast radius if exploitation occurs (GitHub Advisory).

The vulnerability was reported by EQSTLab and credited in the GitHub security advisory. The Pydantic maintainer dsfaccini published the fix and advisory, noting that the AGUIAdapter is not affected by default due to the preserve_file_data flag being off. Red Hat's Product Security team tracked the issue via Bugzilla (Bug 2508669) and classified it as medium severity. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat Bugzilla).