CVE-2026-25580

Katalog CVE

CVSS 8.6 · High EPSS 0,74%

Kerentanan Server-Side Request Forgery (SSRF) pada pydantic ai. Skor CVSS 3.1 8.6 (High) menurut github.com.

Deskripsi (NVD)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3 exploit · mitigasi · advisory vendor
• https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301 patch
• https://access.redhat.com/security/cve/CVE-2026-25580
• https://bugzilla.redhat.com/show_bug.cgi?id=2437781
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25580.json