CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.

• CWE-918
• CWE-1289

• https://github.com/pydantic/pydantic-ai/commit/02157e1b87bd45d3f2e111ce07afdf89f9fb0e5b
• https://github.com/pydantic/pydantic-ai/commit/4da70591460f51a8c4f128eaeef70a33340dbd55
• https://github.com/pydantic/pydantic-ai/pull/8401
• https://github.com/pydantic/pydantic-ai/pull/8402
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107283The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107284The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-107285The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-107286Pydantic AI is a Python agent framework for building applica…7.5
• CVE-2026-107287Pydantic AI is a Python agent framework for building applica…6.5
• CVE-2026-107288Pydantic AI is a Python agent framework for building applica…3.7
• CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2
• CVE-2026-107290Pydantic AI is a Python agent framework for building applica…6.5
• CVE-2026-107291Pydantic AI is a Python agent framework for building applica…2.3
• CVE-2026-107292Pydantic AI is a Python agent framework for building applica…6.4
• CVE-2026-107293Pydantic AI is a Python agent framework for building applica…2.3
• CVE-2026-107294Pydantic AI is a Python agent framework for building applica…6.5