PT-2026-6796 · Unknown+1 · Pydantic-Ai+6

Doredry + 1 · Published 2026-02-06 · Updated 2026-02-08 · CVE-2026-25580

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 0.0.26 through 1.55.9

Description A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users, such as those using Agent.to web, clai web, VercelAIAdapter, AGUIAdapter, or Agent.to ag ui, or custom APIs that accept message history from user input. The download item() helper function downloads content from URLs without validating that the target is a public internet address. Attackers can potentially access internal services, steal cloud credentials, or scan internal networks. Multiple model integrations download URL content in certain conditions, including OpenAIChatModel, AnthropicModel, GoogleModel, XaiModel, BedrockConverseModel, and OpenRouterModel.

Recommendations Upgrade to version 1.56.0 or later. If a project cannot upgrade immediately, use a history processor to filter out URLs targeting local/private addresses.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-25580

GHSA-2JRP-274C-JHV3

Affected Products

Anthropicmodel

Bedrockconversemodel

Googlemodel

Openaichatmodel

Openroutermodel

Pydantic-Ai

Xaimodel

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25580.json · Exploit
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3 · Vendor Advisory
• https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301 · Patch
• https://osv.dev/vulnerability/GHSA-2jrp-274c-jhv3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25580 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25580 · Vendor Advisory
• https://github.com/pydantic/pydantic-ai · Note
• https://twitter.com/CVEnew/status/2019885532332060955 · Twitter Post
• https://twitter.com/pulsepatchio/status/2020506391882944730 · Twitter Post
• https://twitter.com/TheHackerWire/status/2019897840865276216 · Twitter Post
• https://twitter.com/CveFindCom/status/2019911852918976887 · Twitter Post