CVE-2026-107289
medium
CVSS v3
6.8
CVSS v4 NEW
—
VIR risk
6.8
Description
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Predictions
Exploit likelihood
77%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | pydantic-ai | >=1.56.0,<1.107.6 | 1.107.6 |
| PyPI | pydantic-ai | >=2.0.0b1,<2.44.0 | 2.44.0 |
| PyPI | pydantic-ai-slim | >=1.56.0,<1.107.6 | 1.107.6 |
| PyPI | pydantic-ai-slim | >=2.0.0b1,<2.44.0 | 2.44.0 |
References
- https://github.com/pydantic/pydantic-ai/commit/02157e1b87bd45d3f2e111ce07afdf89f9fb0e5b
- https://github.com/pydantic/pydantic-ai/commit/4da70591460f51a8c4f128eaeef70a33340dbd55
- https://github.com/pydantic/pydantic-ai/pull/8401
- https://github.com/pydantic/pydantic-ai/pull/8402
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3
- https://github.com/pydantic/pydantic-ai
CWEs
CWE-918 CWE-1289
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.