Pydantic AI versions 0.0.26 through 1.55.x are vulnerable to a Server-Side Request Forgery flaw that could allow unauthorized access to internal network services or cloud credentials.

This is a Server-Side Request Forgery (CWE-918) vulnerability located in the URL download functionality of the framework. It allows an unauthenticated attacker to manipulate the application into performing requests against internal infrastructure when the application processes message history from untrusted sources.

The ability to perform SSRF poses a significant risk to the internal network perimeter. An attacker can leverage this vulnerability to bypass firewalls and interact with internal-only services, sensitive metadata endpoints, or cloud service provider credentials, potentially leading to a full compromise of the application environment. Given the CVSS score of 8.6, this is a high-severity issue that requires immediate attention to prevent unauthorized data exfiltration or service disruption.

Immediate Action: Update the pydantic-ai and pydantic-ai-slim packages to version 1.56.0 or later via the Python Package Index (PyPI).

Proactive Monitoring: Review application access logs for unusual outbound requests, particularly those targeting internal IP ranges or sensitive cloud metadata service endpoints (e.g., 169.254.169.254).

Compensating Controls: Implement egress filtering on the server hosting the application to restrict outbound network connections to only known, trusted domains and prevent access to internal private network segments.

Public Exploit Available: Unknown

Organizations utilizing Pydantic AI to process message history from external sources must prioritize this update. Because the vulnerability is automatable and requires no authentication, the risk of exploitation is elevated. Ensure that all affected instances are patched to version 1.56.0 immediately to eliminate the SSRF vector.