CVE-2026-48782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48782", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T20:18:20.365Z", "datePublished": "2026-06-16T22:49:26.750Z", "dateUpdated": "2026-06-17T14:22:48.236Z"}, "containers": {"cna": {"title": "pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59"}, {"name": "https://github.com/pydantic/pydantic-ai/pull/5596", "tags": ["x_refsource_MISC"], "url": "https://github.com/pydantic/pydantic-ai/pull/5596"}, {"name": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4", "tags": ["x_refsource_MISC"], "url": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4"}, {"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0"}], "affected": [{"vendor": "pydantic", "product": "pydantic-ai", "versions": [{"version": ">= 1.56.0, < 1.102.0", "status": "affected"}, {"version": ">= 2.0.0b1, < 2.0.0b3", "status": "affected"}]}, {"vendor": "pydantic", "product": "pydantic-ai-slim", "versions": [{"version": ">= 2.0.0b1, < 2.0.0b3", "status": "affected"}, {"version": ">= 1.56.0, < 1.102.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T22:49:26.750Z"}, "descriptions": [{"lang": "en", "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3."}], "source": {"advisory": "GHSA-cg7w-rg45-pc59", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T14:22:37.373304Z", "id": "CVE-2026-48782", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:22:48.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T14:22:37.373304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:22:42.483Z"}}], "cna": {"title": "pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)", "source": {"advisory": "GHSA-cg7w-rg45-pc59", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pydantic", "product": "pydantic-ai", "versions": [{"status": "affected", "version": ">= 1.56.0, < 1.102.0"}, {"status": "affected", "version": ">= 2.0.0b1, < 2.0.0b3"}]}, {"vendor": "pydantic", "product": "pydantic-ai-slim", "versions": [{"status": "affected", "version": ">= 2.0.0b1, < 2.0.0b3"}, {"status": "affected", "version": ">= 1.56.0, < 1.102.0"}]}], "references": [{"url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59", "name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pydantic/pydantic-ai/pull/5596", "name": "https://github.com/pydantic/pydantic-ai/pull/5596", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4", "name": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0", "name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T22:49:26.750Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48782", "state": "PUBLISHED", "dateUpdated": "2026-06-17T14:22:48.236Z", "dateReserved": "2026-05-22T20:18:20.365Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-16T22:49:26.750Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pydantic-ai", "vendor": "pydantic", "versions": [{"status": "affected", "version": ">= 1.56.0, < 1.102.0"}, {"status": "affected", "version": ">= 2.0.0b1, < 2.0.0b3"}]}, {"product": "pydantic-ai-slim", "vendor": "pydantic", "versions": [{"status": "affected", "version": ">= 2.0.0b1, < 2.0.0b3"}, {"status": "affected", "version": ">= 1.56.0, < 1.102.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*", "matchCriteriaId": "E0883AD9-EE3D-4EA1-8671-3DBACF3B5DA6", "versionEndExcluding": "1.102.0", "versionStartIncluding": "1.56.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta1:*:*:*:python:*:*", "matchCriteriaId": "7F40BA40-4529-43DA-A120-BD18300297A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pydantic:pydantic_ai:2.0.0:beta2:*:*:*:python:*:*", "matchCriteriaId": "9CA57AD6-2B0E-4DCB-A2B7-902A1E65CA1C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3."}], "id": "CVE-2026-48782", "lastModified": "2026-08-06T18:30:13.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48782", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T14:22:37.373304Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:20:43.210", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pydantic/pydantic-ai/pull/5596"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "pydantic-ai: Pydantic AI: Information Disclosure via Cloud-Metadata Blocklist Bypass", "id": "2489704", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489704"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-289", "details": ["A flaw was found in Pydantic AI, where its cloud-metadata blocklist could be bypassed. This vulnerability allows an attacker to expose cloud IAM (Identity and Access Management) short-term credentials. The bypass occurs when an application using Pydantic AI is configured to allow local file downloads and operates on networks that route specific IPv6 (Internet Protocol version 6) transition forms, which were not properly decoded by a previous fix. This could lead to unauthorized access to cloud resources through information disclosure."], "name": "CVE-2026-48782", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-06-16T22:49:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48782\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48782\nhttps://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4\nhttps://github.com/pydantic/pydantic-ai/pull/5596\nhttps://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0\nhttps://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.56.0,1.102.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0b1,2.0.0b3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pydantic-ai", "source": "cna", "vendor": "pydantic"}, "product": "pydantic-ai", "vendor": "pydantic"}], "created": "2026-06-17T01:30:04.921760+00:00", "updated": "2026-06-18T13:00:16.334245+00:00", "vendors": ["pydantic", "pydantic$PRODUCT$pydantic-ai"]}