CVE-2026-65975: Pydantic AI UI adapters execute unresolved tool calls from client history

Summary

Pydantic AI versions 1.88.0 up to 1.107.1 and 2.0.0b1 up to 2.5.0 have a flaw in the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and VercelAIAdapter). When a trailing client message sanitizes to empty and is dropped, as with a client system message under manage_system_prompt='server', an assistant response with an unresolved tool call is dispatched without inspection. A remote client can thereby run a registered, non-approval server tool with client-supplied arguments. Applications that gate tools in before_model_request or after_model_request are most affected, since forged calls skip that guardrail; requires_approval=True tools are not auto-executed by this path.

Mitigation

Fixed in 1.107.1 and 2.5.0.

Topics

• AI agents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online