AIKIDO-2026-187702
pydantic-ai-slim is vulnerable to Server-Side Request Forgery (SSRF)
68
CVE Score
Medium
Server-Side Request Forgery (SSRF)
TL;DR
When an application opts a URL into local network access, the cloud-metadata IP blocklist compares addresses by set membership, and Python includes an IPv6 zone identifier in that address's equality and hashing. A metadata address written with a zone identifier does not match the blocklist even though the network stack ignores the zone identifier and delivers the request to the metadata endpoint anyway, exposing cloud IAM credentials on IPv6-enabled hosts. The fix drops the zone identifier before comparing an address against the metadata and private-range blocklists.
How do I fix this?
Upgrade the pydantic-ai-slim and/or the pydantic-ai library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you opt a URL into local network access with FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True) in an IPv6-enabled environment.
Package
Versions
1.56.0 - 1.107.5
Fixed in 1.107.62.0.0 - 2.43.0
Fixed in 2.44.0Background info
pydantic-ai-slim is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 - 1.107.5 and 2.0.0 - 2.43.0.
Links
GitHub Releases
Fix Commits
github.com/pydantic/pydantic-ai/commit/02157e1b87bd45d3f2e111ce07afdf89f9fb0e5bgithub.com/pydantic/pydantic-ai/commit/4da70591460f51a8c4f128eaeef70a33340dbd55
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.