CVE-2026-107288 pydantic CVE debrief

Who should care

Defenders responsible for Pydantic AI deployments should assess exposure and prioritize updates to fixed versions. They should also review model inputs and restrict them to prevent attacker-influenced hostnames.

Why it matters

Defenders should care about this vulnerability because it allows an attacker-influenced model to bypass blocked_domains checks, potentially leading to unauthorized host access with application privileges. Affected versions need to be updated to 1.107.6 or 2.44.0, and model inputs should be reviewed and restricted to prevent this bypass.

• Potential unauthorized host access with application privileges
• Need to verify affected versions and update to fixed versions
• Requires review and restriction of model inputs to prevent attacker-influenced hostnames
• Monitoring for unusual web_fetch_tool activity is necessary

Technical summary

The vulnerability occurs because the local web_fetch_tool and WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string.

Defensive priority

Defenders should prioritize verifying affected versions and updating to fixed versions 1.107.6 or 2.44.0. They should also review and restrict model inputs to prevent attacker-influenced hostnames.

Recommended defensive actions

• Verify if Pydantic AI versions 1.77.0 to 1.107.6 or 2.44.0 are in use and update to 1.107.6 or 2.44.0
• Review and restrict model inputs to prevent attacker-influenced hostnames
• Monitor for unusual web_fetch_tool activity
• Perform vulnerability scanning to identify potentially exposed systems
• Implement additional logging and monitoring for web_fetch_tool activity
• Review and update incident response plans to address potential exploitation
• Conduct a thorough risk assessment to identify potential attack vectors

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. However, there is limited information on potential exploitation or victim impact. Defenders should verify affected versions, review model inputs, and monitor for unusual activity. The vulnerability allows an attacker-influenced model to bypass blocked_domains checks, potentially leading to unauthorized host access with application privileges. Evidence is limited, and further verification is needed to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.