PatchSiren cyber security CVE debrief
CVE-2026-48782 pydantic CVE debrief
CVE-2026-48782 is a medium-severity vulnerability in Pydantic AI, a Python agent framework for building applications and workflows with Generative AI. The issue affects versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2. An attacker can bypass the cloud-metadata blocklist by encoding metadata IP in an IPv6 transition form, exposing cloud IAM short-term credentials. This occurs when an application using Pydantic AI opts for force_download='allow-local' and runs on a network that routes affected IPv6 transition forms, such as NAT64-configured networks or networks with an ISATAP tunnel. The vulnerability has been fixed in version 2.0.0b3.
- Vendor
- pydantic
- Product
- pydantic-ai
- CVSS
- MEDIUM 6.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-17
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-17
Who should care
Security teams and developers using Pydantic AI, especially those with cloud-based deployments, should be aware of this vulnerability. They should assess their usage of Pydantic AI and update to version 2.0.0b3 or later to mitigate the risk.
Technical summary
The vulnerability arises from the incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678. The previous fix only decoded IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, leaving other transition forms vulnerable. An attacker can exploit this by encoding the metadata IP in an IPv6 transition form, such as IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, or ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint when force_download='allow-local' is enabled.
Defensive priority
Medium
Recommended defensive actions
- Update Pydantic AI to version 2.0.0b3 or later
- Disable force_download='allow-local' if not required
- Assess and restrict network access to Pydantic AI applications
- Monitor for suspicious activity related to cloud IAM credentials
- Review and update security configurations for NAT64-configured networks or ISATAP tunnels
- Consider implementing additional security measures for cloud-based deployments
Evidence notes
The information provided is based on the official CVE record and NVD details. The vulnerability has been publicly disclosed and a fix is available. However, the effectiveness of the fix and potential attack vectors should be further assessed and tested.
Official resources
CVE-2026-48782 was published on 2026-06-17T13:20:43.210Z and modified on 2026-06-17T16:28:24.220Z.