Listen to this Post
CVE-2026-46678 is a Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI, a Python agent framework for building Generative AI applications. The flaw resides in the cloud-metadata blocklist mechanism when the `force_download=’allow-local’` option is enabled. By default, Pydantic AI blocks requests to private and internal IP addresses. However, when an application explicitly opts a URL into force_download='allow-local', this default block is disabled.
This vulnerability is an incomplete fix of a previous issue, CVE-2026-25580. The earlier remediation attempted to block cloud metadata endpoints even when `allow-local` was enabled. However, this guarantee did not hold for IPv6-encoded forms of the metadata IPs.
An attacker can bypass the cloud-metadata blocklist by encoding the metadata IP (e.g., 169.254.169.254) in various IPv6 transition forms. These forms include IPv4-mapped IPv6 (e.g., ::ffff:169.254.169.254), 6to4, and NAT64 prefixes. On dual-stack or translated networks, the IPv6 wrapper is routed to the underlying IPv4 metadata endpoint. This exposes cloud IAM short-term credentials, which can be used to escalate privileges or access other cloud resources.
The attack surface is materially narrower than the parent CVE, as exploitation requires specific conditions. The application must explicitly opt a `FileUrl` (e.g., ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into `force_download=’allow-local’` on a URL influenced by untrusted input. The vulnerability does not affect applications using bundled integrations like Agent.to_web, VercelAIAdapter, or AGUIAdapter, as they do not propagate `force_download` from external data. It also does not affect applications that only download from developer-controlled URLs.
The issue has been fixed in version 1.99.0, which extends blocklists to cover IPv6 transition forms routing to blocked IPv4 endpoints.
DailyCVE Form:
Platform: ……. Pydantic AI
Version: …….. 1.56.0 to 1.98.0
Vulnerability :…… SSRF via IPv6 encoding
Severity: ……. Medium (CVSS 6.8)
date: ………. July 29, 2026
Prediction: ….. August 15, 2026
Analytics under What Undercode Say:
Check installed version pip show pydantic-ai | grep Version Identify vulnerable versions python -c "import pydantic_ai; print(pydantic_ai.<strong>version</strong>)"
The vulnerability exploits the `is_private_ip` function’s incomplete blocklist. An attacker can submit a URL with an IPv6-encoded metadata IP to bypass the filter.
Example vulnerable code snippet:
from pydantic_ai import FileUrl VULNERABLE: force_download='allow-local' on untrusted input url = untrusted_user_input e.g., "http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/" file_url = FileUrl(url, force_download='allow-local')
The attack is only possible in environments that route these IPv6 forms, such as dual-stack or NAT64-configured networks.
Exploit:
An attacker can craft a URL using an IPv4-mapped IPv6 address to access the cloud metadata service:
http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/
Other bypass forms include:
- 6to4: `http://[2002:ac1f:ac1f]/latest/meta-data/` (where `ac1f:ac1f` is hex for 169.254.169.254)
- NAT64 well-known prefix: `http://[64:ff9b::a9fe:a9fe]/latest/meta-data/`
These encoded addresses bypass the blocklist because the validation logic only checks against a list of literal IPv4 addresses and does not decode the IPv6 transition forms.
Protection:
- Upgrade: Update to Pydantic AI version 1.99.0 or later.
- Avoid
allow-local: Do not pass `force_download=’allow-local’` on any URL that could be influenced by untrusted input. - Manual Validation: If `allow-local` is necessary, resolve the hostname and validate the IP against a comprehensive blocklist that includes IPv6-encoded forms.
- Network Restrictions: Restrict outbound network access from the application server to the metadata service using firewalls or security groups.
Impact:
- Confidentiality: An attacker can retrieve cloud IAM short-term credentials. This can lead to unauthorized access to cloud resources and data.
- Integrity: No direct impact on integrity.
- Availability: No direct impact on availability.
- Scope: The vulnerability has a changed scope, meaning it can affect resources beyond the vulnerable component.
- Attack Complexity: High, as it requires the application to opt into `allow-local` and the network to route IPv6 transition forms.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
