SSRF (Server-Side Request Forgery) in pydantic-ai-slim (CVE-2026-54249)
Summary
SSRF in pydantic-ai-slim (CVE-2026-54249). Confidential information can be exposed externally. Exploitable via UploadedFile. Mitigation: upgrade to 2.0.0b6 or later.
Original description
The description as published by the source.
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-54249 has been found in pydantic-ai-slim.
Attackers can target a specific entry point like UploadedFile over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 6.8/10.
What to do: upgrade pydantic-ai-slim to 2.0.0b6 or later.
If unsure, ask your IT team or search "pydantic-ai-slim CVE-2026-54249" on the vendor's site.
CVE-2026-54249 (pydantic-ai-slim) — CWE-918 / CVSS v3 6.8
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: UploadedFile
Patched: 2.0.0b6 — apply immediately
Workaround: If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip UploadedFile parts from incoming messages before running the agent.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
SSRF (CWE-918) exists in pydantic-ai-slim. Attackers reach the vulnerable code path via UploadedFile without authentication.
Check the vendor advisory for the affected versions of pydantic-ai-slim. Attack surface: UploadedFile.
Severity: Medium (CVSS 6.8/10). Confidential information can be exposed externally.
Update to 2.0.0b6.
Workaround: If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip UploadedFile parts from incoming messages before running the agent.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'pydantic-ai-slim' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'pydantic-ai-slim' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
pydantic-ai-slimを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.パッチが適用されるまでの応急処置として、If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip
UploadedFileparts from incoming messages before running the agent. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade pydantic-ai-slim to 2.0.0b6ステージング環境で 2.0.0b6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- advisory github.com
- package github.com
- package pypi.org
- package pypi.org
- web github.com
- web github.com