PT-2026-65904 · Pypi · Pydantic-Ai

CVE-2026-54249 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.65.0 through 1.105.0 Pydantic AI versions 2.0.0b1 through 2.0.0b5

Description A client submitting message history to a UI adapter can reference arbitrary files within the application's model-provider or cloud-storage account. While file URL parts are checked against a scheme allowlist, UploadedFile references—which use provider file IDs or cloud-storage URIs (such as s3:// or gs://)—are forwarded without validation. Since the provider resolves these references using the server-side identity (such as an IAM role, service account, or provider API key) instead of the client's identity, an attacker with a valid file identifier can force the server to read objects from its own account or other tenants.

Recommendations Update to version 1.106.0. Update to version 2.0.0b6.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54249

GHSA-H7P7-W5GC-XJ3W

Affected Products

Pydantic-Ai

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54249.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54249 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54249 · Vendor Advisory
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w · Note