8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25580

CVE-2026-25580: Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25580

CVE-2026-25580:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pydantic-ai	pip	>= 0.0.26, < 1.56.0	1.56.0
pydantic-ai-slim	pip	>= 0.0.26, < 1.56.0	1.56.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly names the download_item() function as the source of the SSRF vulnerability. Analysis of the provided commit d398bc9d39aecca6530fa7486a410d5cce936301 confirms this. The patch modifies the pydantic_ai/models/__init__.py file, where the download_item function is located. The change replaces a direct and unsafe call to client.get(item.url) with a new safe_download function that implements comprehensive SSRF protection. The safe_download function, introduced in pydantic_ai/_ssrf.py, validates URL protocols, resolves hostnames to IPs, and blocks requests to private networks and cloud metadata endpoints before making any request. The vulnerable code was the line response = await client.get(item.url, follow_redirects=True), which blindly trusted the user-supplied URL. Therefore, pydantic_ai.models.download_item is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

pydantic_ai.models.download_item

pydantic_ai_slim/pydantic_ai/models/__init__.py

This function was responsible for downloading content from a URL. Before the patch, it used `httpx.client.get` to fetch the URL directly from the user-provided `item.url` without any validation. This allowed an attacker to specify internal or cloud-metadata URLs, leading to a Server-Side Request Forgery (SSRF) vulnerability. The function would make requests to arbitrary URLs provided by an attacker.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.