What happened
NVD published three related Pydantic AI CVEs on 2026-07-29 covering an SSRF cloud-metadata blocklist bypass and two UI-adapter arbitrary-file-reference vulnerabilities in the AG-UI/Vercel AI integrations.
Why it matters
Pydantic AI is a widely-adopted Python agent framework; SSRF against cloud-metadata endpoints from within an agent process can lead to cloud credential theft (IAM role tokens), and the UI-adapter file-disclosure bugs let a remote client pull arbitrary files from the server hosting the agent purely through crafted chat history — a serious data-exposure path for any deployed Pydantic AI chat UI.
Attack vector
When an application opts a URL into force_download='allow-local' (disabling the default private/internal-IP block), the cloud-metadata blocklist can be bypassed by encoding the metadata IP in an alternate form, enabling SSRF against cloud metadata services (CVE-2026-46678). Separately, a client submitting message history to a Pydantic AI UI adapter (Vercel AI/AG-UI) can reference arbitrary files on the model's filesystem via crafted history entries (CVE-2026-54249, CVE-2026-65975), since sanitize_message_history did not fully block file-reference injection.
Affected systems
pydantic-ai versions 1.56.0–1.98.0 (CVE-2026-46678); 1.65.0–1.105.0 and 2.0.0b1–2.0.0b5 (CVE-2026-54249); 1.88.0–1.107.0 and 2.0.0b1–2.4.x (CVE-2026-65975)
Mitigation
Upgrade to pydantic-ai 1.99.0+ (CVE-2026-46678 fix) and to the versions referenced in GHSA-h7p7-w5gc-xj3w / GHSA-jpr8-2v3g-wgf9 for the UI-adapter file-disclosure issues.