CVE-2026-48782

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3.

• CWE-918

• https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4Patch
• https://github.com/pydantic/pydantic-ai/pull/5596Issue Tracking, Patch
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0Product, Release Notes
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59Vendor Advisory

Published

Jun 17, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48777FileBrowser Quantum is a free, self-hosted, web-based file m…9.3
• CVE-2026-48778Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-48779ws is an open source WebSocket client and server for Node.js…7.5
• CVE-2026-4878A flaw was found in libcap. A local unprivileged user can ex…7
• CVE-2026-48780Forem is open source software for building communities. Prio…8.2
• CVE-2026-48781Postiz is an AI social media scheduling tool. In versions pr…9.9
• CVE-2026-48783Postiz is an AI social media scheduling tool. Versions prior…4.8
• CVE-2026-48784Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5