Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

SummaryWhen an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form IPv4-mapped IPv6, 6to4, or NAT64. Dual-stack and...

PYSEC-2026-2982 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Summary When an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form IPv4-mapped IPv6, 6to4, or NAT64. Dual-stack an...

ara-cli (>=0.1.14.13, <=0.1.14.14), clai (>=1.56.0, <=1.98.0) +44 more potentially affected by CVE-2026-25580 +1 more via pydantic-ai-slim (>=1.56.0, <=1.98.0)

pydantic-ai-slim PYPI version =1.56.0, =0.1.14.13, =1.56.0, =0.0.400, =1.0.0, =1.0.3, =0.1.102, =0.1.0, =0.1.1, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =26.1.0rc1, =26.1.0 and more Source cves: CVE-2026-25580, CVE-2026-46678 Source advisory: SNYK:PYTHON-PYDANTICAISLIM-16796278...

adept-ai (>=0.2.0, <=0.2.3), agent-runtimes (0.0.9) +74 more potentially affected by CVE-2026-25580 via pydantic-ai-slim (>=0.0.26, <=1.55.0)

pydantic-ai-slim PYPI version =0.0.26, =0.2.0, =0.2.0, =0.1.4a1, =0.1.0, =0.3.0, =0.0.2, =0.1.0, =0.1.2, =0.1.1a0, =0.1.11, =0.0.174, =0.0.399 and more Source cves: CVE-2026-25580 Source advisory: MEND:CVE-2026-25580...

adept-ai (>=0.2.0, <=0.2.3), agent-runtimes (0.0.9) +74 more potentially affected by CVE-2026-25580 via pydantic-ai-slim (>=0.0.26, <=1.55.0)

pydantic-ai-slim PYPI version =0.0.26, =0.2.0, =0.2.0, =0.1.4a1, =0.1.0, =0.3.0, =0.0.2, =0.1.0, =0.1.2, =0.1.1a0, =0.1.11, =0.0.174, =0.0.399 and more Source cves: CVE-2026-25580 Source advisory: OSV:GHSA-2JRP-274C-JHV3...