Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

The SSRF vulnerability in Pydantic AI poses a significant risk to applications that handle user-provided message history. An attacker could craft a malicious URL within this history, causing the Pydantic AI server to send HTTP requests to internal systems. This could lead to unauthorized access to internal APIs, databases, or cloud credentials. The blast radius extends to any internal resource accessible via HTTP, potentially exposing sensitive information or enabling further attacks. Successful exploitation could allow an attacker to map the internal network, identify vulnerable services, and potentially escalate privileges.

Applications built with Pydantic AI that accept message history from external users are at the highest risk. This includes chatbots, virtual assistants, and other AI-powered applications where user input is processed and used to generate responses. Specifically, deployments relying on untrusted message history sources or lacking robust input validation are particularly vulnerable.

• python / server:

import requests
import re

def check_pydantic_ai_ssrf(url):
    # Check for URL patterns indicative of SSRF attempts
    if re.search(r'^(?:127\.0\.0\.1|localhost|192\.168\.\d+\.\d+|10\.0\.\d+\.\d+)', url):
        print(f"Potential SSRF attempt detected: {url}")

# Example usage (replace with actual message history)
message_history = "...malicious_url_here..."
check_pydantic_ai_ssrf(message_history)

• generic web:

curl -I <your_pydantic_ai_endpoint> | grep -i 'Server:'

• generic web:

 grep -E 'http://127.0.0.1:8000|http://localhost:8000' /var/log/nginx/access.log

1. 2026-02-06Disclosure

   disclosure

1. Reserviert2026-02-03
2. Veröffentlicht2026-02-06
3. Geändert2026-02-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25580 is to upgrade Pydantic AI to version 1.56.0 or later, which includes a fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing input validation on message history to sanitize URLs and prevent the inclusion of malicious content. Additionally, restrict network access for the Pydantic AI server to only the necessary resources. Web Application Firewalls (WAFs) configured to block suspicious URL patterns can provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a known malicious URL into message history and verifying that the server does not make an unauthorized request.