PyPI/pydantic-ai CVE-2026-46678: medium 6.8, EPSS 0.38%

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Action: Upgrade pydantic-ai to 1.99.0 or later.

pip install pydantic-ai==1.99.0

Affected

Fixed versions

Sources

• osv: GHSA-cqp8-fcvh-x7r3
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3
• https://github.com/pydantic/pydantic-ai

CVE-2026-46678 · published 2026-05-21T21:35:18Z · modified 2026-07-13T16:43:22.591175364Z · JSON