CVE-2026-48782: Pydantic AI Information Disclosure Flaw

CVE-2026-48782 Overview

CVE-2026-48782 is a Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI, a Python agent framework for building Generative AI applications and workflows. The flaw allows attackers to bypass the cloud-metadata blocklist by encoding the metadata IP in IPv6 transition forms that the prior fix for CVE-2026-46678 did not decode. Affected versions include 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2. Successful exploitation exposes cloud Identity and Access Management (IAM) short-term credentials. The issue is tracked as [CWE-918] and was remediated in version 2.0.0b3.

Critical Impact
Attackers can extract cloud IAM short-term credentials from instance metadata endpoints when applications use force_download='allow-local' on networks routing affected IPv6 transition forms.

Affected Products

Pydantic AI versions 1.56.0 through 1.101.0
Pydantic AI version 2.0.0b1
Pydantic AI version 2.0.0b2

Discovery Timeline

2026-06-17 - CVE-2026-48782 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48782

Vulnerability Analysis

The vulnerability resides in the URL handling logic that protects against requests to cloud metadata endpoints. When an application opts a URL into force_download='allow-local', the default block on private and internal IP addresses is disabled. The previous remediation for CVE-2026-46678 decoded only a subset of IPv6 transition forms: IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix. Attackers can supply a metadata IP encoded in a transition form not covered by the decoder. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint, returning IAM credentials. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 (CVE-2026-46678), itself a follow-up to CVE-2026-25580.

Root Cause

The metadata blocklist normalization function fails to canonicalize all IPv6 transition representations before comparing them against blocked IPv4 ranges. The uncovered forms include IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP). Because the decoder does not recognize these forms, the metadata guarantee no longer holds when applications grant local-IP access.

Attack Vector

Exploitation requires an application using Pydantic AI to opt a URL into force_download='allow-local' and to run on a network that routes the affected IPv6 transition forms. Vulnerable environments include NAT64-configured IPv6-only or dual-stack-with-NAT64 networks, certain Kubernetes deployments, and networks operating ISATAP tunnels. Standard dual-stack cloud VMs or containers do not route these forms and are not exploitable in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth.

The attacker supplies a crafted URL containing an IPv6 transition-form representation of the cloud metadata IP (typically 169.254.169.254). The library accepts the address as non-local, then dispatches the request to the underlying IPv4 metadata endpoint and returns the response containing IAM credentials. No authentication or user interaction is required.

Detection Methods for CVE-2026-48782

Indicators of Compromise

Outbound application requests to the cloud metadata IP (169.254.169.254) or equivalent IPv6 metadata endpoints originating from Pydantic AI workloads.
URLs containing IPv6 transition-form encodings such as ::a.b.c.d, 64:ff9b:1::/48 prefixes, operator-defined NAT64 prefixes, or ISATAP-formatted addresses.
Unexpected use of short-term IAM credentials from cloud audit logs by hosts running Pydantic AI agents.

Detection Strategies

Inspect application logs for URLs passed to Pydantic AI with force_download='allow-local' and validate the destination host.
Correlate egress proxy or service mesh logs with requests targeting metadata endpoints from agent workloads.
Monitor cloud audit trails (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for instance role credential reuse from unexpected source IPs.

Monitoring Recommendations

Enable IMDSv2 enforcement on AWS and equivalent hop-limit protections on other clouds to reduce credential theft impact.
Add network policies that block pod or workload egress to 169.254.169.254 and the IPv6 metadata equivalents unless explicitly required.
Alert on Pydantic AI process versions older than 2.0.0b3 in software inventory feeds.

How to Mitigate CVE-2026-48782

Immediate Actions Required

Upgrade Pydantic AI to version 2.0.0b3 or later across all environments running affected releases.
Audit application code for use of force_download='allow-local' and remove the setting where local access is not strictly required.
Rotate any IAM short-term credentials that may have been exposed on NAT64 or ISATAP-routed networks.

Patch Information

The issue has been fixed in Pydantic AI 2.0.0b3. The fix extends the IPv6 transition decoder to cover IPv4-compatible IPv6, RFC 8215 NAT64 local-use prefixes, operator-chosen NAT64 prefixes, ISATAP, and Teredo before applying the metadata blocklist. See the GitHub Security Advisory GHSA-cg7w-rg45-pc59, GitHub Pull Request #5596, and the commit applying the fix.

Workarounds

Disable the force_download='allow-local' option in application configurations until the upgrade is deployed.
Apply egress network policies that block routing to 169.254.169.254 and IPv6 metadata equivalents from agent workloads.
Where NAT64 or ISATAP is not required, disable these transition mechanisms at the network layer to remove the routing precondition.

bash

# Configuration example: upgrade Pydantic AI to the patched release
pip install --upgrade 'pydantic-ai>=2.0.0b3'

# Verify the installed version
python -c "import pydantic_ai; print(pydantic_ai.__version__)"