MediumVulnerability

GHSA-cqp8-fcvh-x7r3: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-46678GHSA-cqp8-fcvh-x7r3
Published: May 21, 2026
Record updated: October 9, 2026

Affected: pydantic-ai-slim >= 1.56.0, < 1.99.0
pydantic-ai >= 1.56.0, < 1.99.0
Fixed in: 1.99.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.4%

Summary

Pydantic AI versions with an incomplete fix for GHSA-2jrp-274c-jhv3 / CVE-2026-25580 let an attacker bypass the cloud-metadata blocklist by encoding the metadata IP in IPv6 transition forms (IPv4-mapped IPv6, 6to4, or NAT64). This affects applications that set force_download='allow-local' on a URL influenced by untrusted input, and dual-stack or translated networks can route the request to the IPv4 metadata endpoint, exposing cloud IAM short-term credentials.

Mitigation

Upgrade to 1.99.0 or later. Until then, avoid passing force_download='allow-local' on any URL that untrusted input could influence, or resolve the hostname yourself and validate it, including IPv6-encoded forms, against your own metadata blocklist before constructing the FileUrl.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.4%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 14, 2026.
Disclosure date: May 21, 2026

Affected

Packages: pydantic-ai-slim@>= 1.56.0, < 1.99.0 (fixed: 1.99.0)
pydantic-ai@>= 1.56.0, < 1.99.0 (fixed: 1.99.0)

Classification

Attack type: Other
Attack sophistication: Advanced
AI component targeted: Framework
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-cqp8-fcvh-x7r3

First tracked: May 21, 2026 at 08:00 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

pydantic-aiPyPILLM dependency since 2024-05-20 · 4 tracked dependents
pydantic-ai-slimPyPILLM dependency since 2024-11-25 · 7 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items