Listen to this Post
CVE-2026-54249 is a Server-Side Request Forgery (SSRF) vulnerability affecting Pydantic AI, a Python agent framework for building Generative AI applications. The flaw exists in versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5. The root cause lies in how UI adapters—such as the Vercel AI adapter—reconstruct file parts from client-submitted message history and forward them to the model provider.
When a client submits a message history containing a file reference, the adapter distinguishes between two types: `FileUrl` and UploadedFile. `FileUrl` references are validated against a scheme allowlist before being forwarded. However, `UploadedFile` references—which point to a file by provider file ID or cloud-storage URI (e.g., s3://…, gs://…)—are forwarded without any validation.
The critical security impact arises because the provider resolves an `UploadedFile` using the server-side identity—such as an IAM role, service account, or provider API key—rather than the client’s credentials. This creates a confused deputy scenario: an attacker can craft a message history containing an attacker-chosen `UploadedFile` reference and cause the server to read objects from its own cloud-storage account or even from other tenants, provided a referenceable identifier exists.
Exploitation requires the attacker to know a valid file identifier. Depending on how the application names objects, such identifiers are not always unguessable—for example, if the application uses predictable naming schemes like sequential IDs or timestamps, an attacker may be able to enumerate or guess valid references.
The vulnerability affects any application that passes untrusted client-submitted message history to an agent through a UI adapter. The fix, implemented in versions 1.106.0 and 2.0.0b6, validates `UploadedFile` references on client-submitted messages the same way `FileUrl` references are validated. Additionally, the patch drops `UploadedFile` items from client-submitted messages unless the new `preserve_file_data` flag is explicitly enabled. As a workaround, administrators can strip `UploadedFile` parts from incoming messages before running the agent.
DailyCVE Form:
Platform: Pydantic AI
Version: 1.65.0-1.105.0, 2.0.0b1-2.0.0b5
Vulnerability: Server-Side Request Forgery (SSRF)
Severity: Medium (CVSS 0.0)
date: 2026-07-29
Prediction: 2026-08-11
What Undercode Say:
- Attackers can read arbitrary cloud objects.
- Server credentials are abused by clients.
- File identifiers may be guessable.
- UI adapters are the attack surface.
- No public exploits known yet.
Analytics:
Check installed version
pip show pydantic-ai | grep Version
Check if vulnerable (1.65.0 <= version <= 1.105.0)
python -c "import pydantic_ai; print(pydantic_ai.<strong>version</strong>)"
List all UploadedFile references in message history
grep -r "UploadedFile" /path/to/your/app/
Simulate a malicious message payload (example)
echo '{"messages":[{"role":"user","content":[{"type":"file","data":{"providerMetadata":{"uploadedFile":{"id":"s3://attacker-bucket/sensitive-data"}}}}}]}' > payload.json
Exploit:
An attacker crafts a message history containing an `UploadedFile` reference pointing to an arbitrary cloud-storage URI (e.g., s3://victim-bucket/secret.txt) or provider file ID. This payload is submitted to the application’s UI adapter endpoint. The server, using its own high-privilege credentials, forwards the reference to the model provider, which fetches and returns the contents of the referenced file to the attacker.
Protection:
Upgrade to Pydantic AI version 1.106.0 (1.x) or 2.0.0b6 (2.x beta) immediately. If an upgrade is not possible, do not pass untrusted client-submitted message history to the agent, or explicitly strip `UploadedFile` parts from incoming messages before running the agent. Additionally, restrict cloud-storage IAM roles to the least privilege necessary, and avoid using predictable naming schemes for objects.
Impact:
Successful exploitation allows an attacker to read arbitrary files from the application’s cloud-storage account (e.g., S3, GCS) or from other tenants’ accounts, using the server’s own credentials. This can lead to exposure of sensitive data, including configuration files, credentials, proprietary models, training data, or user data. The impact is amplified if the server has broad IAM permissions or if object names are predictable, enabling mass data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
