CVE-2026-54249 Overview
CVE-2026-54249 is a server-side request forgery [CWE-918] vulnerability in Pydantic AI, a Python agent framework for building generative AI applications. The flaw affects versions 1.65.0 through 1.105.0 and 2.0.0b1 through 2.0.0b5. Clients submitting message history to a Pydantic AI UI adapter, such as the Vercel AI adapter, can reference arbitrary files in the application's model-provider or cloud-storage account through UploadedFile references. The provider resolves these references using the server-side identity rather than the client's identity, enabling cross-tenant object access. Maintainers fixed the issue in versions 1.106.0 and 2.0.0b6.
Critical Impact
Attackers can craft message history payloads containing arbitrary provider file IDs or cloud-storage URIs (s3://, gs://) to read objects from the server's own account or other tenants.
Affected Products
- Pydantic AI versions 1.65.0 through 1.105.0
- Pydantic AI versions 2.0.0b1 through 2.0.0b5
- Applications using Pydantic AI UI adapters such as the Vercel AI adapter
Discovery Timeline
- 2026-07-29 - CVE-2026-54249 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-54249
Vulnerability Analysis
Pydantic AI accepts message history from clients through UI adapters that feed conversational context back into model calls. Message parts can include file references. The framework validates file URL parts against a scheme allowlist to restrict unauthorized protocols. However, UploadedFile references — which identify a file by provider file ID or cloud-storage URI such as s3://bucket/key or gs://bucket/object — bypass this validation and are forwarded to the provider without inspection.
The provider then resolves the reference using the server's identity, typically an IAM role, service account, or provider API key. This confused-deputy pattern grants the requesting client the effective read permissions of the backend service. An attacker submits crafted message history containing a target file identifier and receives the object contents back through the model response or downstream processing.
Root Cause
The root cause is missing authorization and input validation on UploadedFile references within submitted message history. The framework trusts client-supplied file identifiers and delegates resolution to a component operating with elevated, server-side credentials. Access control is not enforced against the requesting client's identity.
Attack Vector
Exploitation occurs over the network without authentication in configurations where the UI adapter is publicly reachable. The attacker crafts a message history payload containing an UploadedFile entry referencing a target provider file ID or cloud-storage URI. Success requires a valid, referenceable identifier. Guessability depends on how the application names objects — predictable schemes such as sequential IDs or user-derived paths substantially lower the exploitation barrier.
Because the vulnerability changes the trust scope from client to server, the impact extends beyond the calling application's data into any object reachable by the server's IAM role, service account, or provider API key.
Detection Methods for CVE-2026-54249
Indicators of Compromise
- Message history payloads containing UploadedFile parts with s3://, gs://, or provider file ID references that do not correspond to objects the requesting user has uploaded.
- Cloud audit logs (AWS CloudTrail, GCS audit logs) showing GetObject calls from the Pydantic AI service identity for buckets or prefixes outside the application's expected scope.
- Unexpected provider file retrieval calls originating from the application service using the shared API key or service account.
Detection Strategies
- Inspect inbound requests to Pydantic AI UI adapter endpoints for UploadedFile message parts and log the referenced identifiers for review.
- Correlate application-level file references with cloud-storage access logs to identify reads that lack a matching client authorization event.
- Alert on cross-tenant or cross-namespace object access patterns from the model-provider or cloud-storage service identity.
Monitoring Recommendations
- Enable object-level access logging on S3 buckets and GCS buckets accessible to the application service account.
- Monitor Pydantic AI application logs for anomalous spikes in UploadedFile resolution or provider file API calls.
- Track the version of pydantic-ai deployed across environments and flag hosts running affected releases.
How to Mitigate CVE-2026-54249
Immediate Actions Required
- Upgrade Pydantic AI to version 1.106.0 or 2.0.0b6 or later across all environments.
- Rotate any provider API keys, IAM role trust policies, or service account credentials that were exposed to the vulnerable service.
- Audit cloud-storage and model-provider access logs for unauthorized UploadedFile resolutions during the exposure window.
Patch Information
The Pydantic maintainers released fixes in pydantic-ai1.106.0 and 2.0.0b6. See the GitHub Security Advisory GHSA-h7p7-w5gc-xj3w for advisory details and patch references.
Workarounds
- Restrict the IAM role or service account used by the Pydantic AI service to the minimum set of buckets and prefixes required, isolating each tenant where possible.
- Use unpredictable, high-entropy object names for uploaded files to reduce the chance of an attacker guessing referenceable identifiers.
- Place the UI adapter behind authentication and validate that every UploadedFile identifier in submitted history belongs to the authenticated user before forwarding to the provider.
# Upgrade Pydantic AI to a fixed release
pip install --upgrade 'pydantic-ai>=1.106.0'
# Or, if tracking the 2.0 beta line
pip install --upgrade 'pydantic-ai==2.0.0b6'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
