High severity · published Feb 6, 2026
CVE-2026-25580
Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
8.6
CVSS
0.7%
EPSS
No
On KEV
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pydantic-ai · pydantic
>= 0.0.26, < 1.56.0 · source: vendor
PA
Pydantic AI · Pydantic
0.0.26 before 1.56.0 · source: NVD
RH
Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25580
Patch
https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301
Exploit
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-25580
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2437781
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25580.json
More from pydantic-ai
7.6
CVE-2026-107295
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution
7.5
CVE-2026-107286
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
6.8
CVE-2026-107289
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)
6.8
CVE-2026-54249
VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection
6.8
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)