CVE-2026-46678 Overview
CVE-2026-46678 is a Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI, a Python agent framework for building Generative AI applications. Affected versions span 1.56.0 through 1.98.0. When an application opts a URL into force_download='allow-local', the cloud-metadata blocklist can be bypassed by encoding the metadata IP in an IPv6 transition form. Attackers can reach cloud metadata endpoints and exfiltrate short-term Identity and Access Management (IAM) credentials on dual-stack or translated networks. The issue is an incomplete fix of CVE-2026-25580 (GHSA-2jrp-274c-jhv3), whose remediation did not cover IPv6-encoded metadata IPs. The flaw is resolved in version 1.99.0.
Critical Impact
Successful exploitation exposes cloud IAM short-term credentials from instance metadata services, enabling lateral movement and privilege escalation within cloud environments.
Affected Products
- Pydantic AI versions 1.56.0 through 1.98.0
- Applications using FileUrl, ImageUrl, AudioUrl, VideoUrl, or DocumentUrl with force_download='allow-local'
- Deployments on dual-stack IPv4/IPv6 or NAT64-translated networks
Discovery Timeline
- 2026-07-29 - CVE-2026-46678 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-46678
Vulnerability Analysis
The vulnerability resides in Pydantic AI's URL download path when callers explicitly set force_download='allow-local'. This mode disables the default block on private and internal IPs, relying instead on a cloud-metadata blocklist to prevent access to instance metadata endpoints such as 169.254.169.254. The blocklist only compares IPv4 literal forms. Attackers can supply the same address in IPv6 transition encodings, including IPv4-mapped IPv6 (::ffff:169.254.169.254), 6to4 (2002:a9fe:a9fe::), or NAT64 (64:ff9b::a9fe:a9fe). On dual-stack hosts, the operating system resolves these to the metadata service, returning cloud IAM tokens to the requesting application. The weakness maps to CWE-918: Server-Side Request Forgery.
Root Cause
The remediation for CVE-2026-25580 normalized and filtered IPv4 metadata addresses but did not canonicalize IPv6 representations of the same targets. Address parsing and blocklist comparison operate on textual form rather than a canonical numeric address, allowing equivalent IPv6-encoded addresses to bypass the check.
Attack Vector
Exploitation requires an application that propagates untrusted input into a FileUrl (or subclass) and explicitly enables force_download='allow-local'. The attacker supplies a URL whose host is an IPv6 transition form of a cloud metadata IP. The Pydantic AI download routine fetches the URL, reaches the instance metadata service, and returns the response, including short-term IAM credentials, to the attacker-controlled code path. Bundled integrations such as Agent.to_web, clai web, VercelAIAdapter, and AGUIAdapter do not propagate force_download from external input and are not affected. Applications that download only from developer-controlled URLs are also unaffected.
Detection Methods for CVE-2026-46678
Indicators of Compromise
- Outbound HTTP requests from application workloads to IPv6 representations of 169.254.169.254, such as ::ffff:a9fe:a9fe, 2002:a9fe:a9fe::, or 64:ff9b::a9fe:a9fe
- Unexpected calls to /latest/meta-data/iam/security-credentials/ or equivalent Azure and GCP metadata paths originating from Pydantic AI processes
- Use of retrieved cloud IAM credentials from source IPs outside the workload's normal egress range
Detection Strategies
- Inspect application logs for FileUrl, ImageUrl, AudioUrl, VideoUrl, or DocumentUrl objects instantiated with force_download='allow-local' where the URL host originates from user input
- Audit Software Bill of Materials (SBOM) data and Python dependency manifests for pydantic-ai versions between 1.56.0 and 1.98.0
- Deploy egress network monitoring that resolves IPv6 hosts to canonical form before matching against metadata IP allowlists
Monitoring Recommendations
- Alert on any workload-originated DNS or connection attempts resolving to link-local or metadata addresses in either IPv4 or IPv6 form
- Enable cloud provider metadata service protections such as AWS IMDSv2 session tokens and hop-limit enforcement
- Correlate short-term IAM credential usage against the issuing instance identity to detect exfiltration and reuse
How to Mitigate CVE-2026-46678
Immediate Actions Required
- Upgrade Pydantic AI to version 1.99.0 or later across all affected services
- Audit application code for any use of force_download='allow-local' on URLs derived from untrusted input and remove or gate that setting
- Rotate any cloud IAM credentials that may have been exposed through vulnerable workloads
Patch Information
The vulnerability is fixed in Pydantic AI 1.99.0. Release notes and remediation details are available in the GitHub Release v1.99.0 and the GitHub Security Advisory GHSA-cqp8-fcvh-x7r3.
Workarounds
- Avoid force_download='allow-local' entirely; rely on the default policy that blocks private and internal IPs
- Restrict downloads to developer-controlled URLs and reject any user-supplied hosts before invoking Pydantic AI file loaders
- Enforce IMDSv2 with a hop limit of 1 on AWS instances, and equivalent metadata hardening on Azure and GCP, so bypasses cannot retrieve credentials
- Block outbound traffic from application workloads to link-local metadata addresses in both IPv4 and IPv6, including transition-form ranges
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
