CVE-2025-22870

PoC – CVE-2025-22870 – HTTP Proxy Bypass via IPv6 Zone ID in Go Summary This Proof of Concept demonstrates the exploitation of CVE-2025-22870, a vulnerability in the golang.org/x/net/http/httpproxy package prior to v0.36.0, which can be used to bypass HTTP proxy restrictions by abusing the way IP...

PYSEC-2026-4282 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

PYSEC-2026-4291 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

SummaryWhen an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

SummaryWhen an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

CVE-2026-107289

A flaw was found in pydantic-ai. This vulnerability can lead to information disclosure, potentially exposing sensitive cloud credentials such as Identity and Access Management IAM tokens. In configurations where local network access is permitted for untrusted requests, a remote attacker can bypas...

Improper Validation of Unsafe Equivalence in Input

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via IPv6 zone identifier handling in the ssrf.py SSRF guard functions iscloudmetadataip and...

Improper Validation of Unsafe Equivalence in Input

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via IPv6 zone identifier handling in the ssrf.py SSRF guard functions iscloudmetadataip and isprivateip. An attacker can supply an...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

The Pydantic AI Python agent framework is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 through 1.107.5 and 2.44.0. When users opt-in to local network access via FileUrl (with force_download='allow-local') or web_fetch_tool (with allow_local_urls=True), an attacker can bypas...

PT-2026-108034

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.56.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description Applications that enable local network access for attacker-influenced URLs via FileUrl with force download='allow-local' or web fetch tool with allow...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

The matching of hosts against proxy patterns may improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to “.example.com”, a request to “::1%25.example.com:80” will be incorrectly matched and not be proxied...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

JLSEC-2026-1169 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...