CVE-2026-107292 is a medium-severity (CVSS 6.4) CWE-346 vulnerability in pydantic-ai. A fix is available for pydantic-ai — see the affected versions and patch details below.
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-107292.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-107292 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
pydantic-ai🐍pydantic-ai🐍pydantic-ai-slim🐍pydantic-ai-slimReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
Details
Once a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Origin check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.
Binding the web UI to localhost — the default — does not prevent this.
Impact
Applications and developers serving an agent through Agent.to_web() or clai web. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.
Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.
Mitigation
Upgrade to pydantic-ai/pydantic-ai-slim >= 2.30.0, or >= 1.107.5 on the v1 maintenance line.
The fix validates the Host header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding 421 Misdirected Request otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:
app = agent.to_web(allowed_hosts=['ui.example.com'])
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | pydantic-ai | ≥ 1.34.0&&< 1.107.5 | 1.107.5pip install --upgrade 'pydantic-ai==1.107.5' |
| 🐍PyPI | pydantic-ai | ≥ 2.0.0b1&&< 2.30.0 | 2.30.0pip install --upgrade 'pydantic-ai==2.30.0' |
| 🐍PyPI | pydantic-ai-slim | ≥ 1.34.0&&< 1.107.5 | 1.107.5pip install --upgrade 'pydantic-ai-slim==1.107.5' |
| 🐍PyPI | pydantic-ai-slim | ≥ 2.0.0b1&&< 2.30.0 | 2.30.0pip install --upgrade 'pydantic-ai-slim==2.30.0' |
Affected Products
pydantic aipydanticDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pydantic-ai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update pydantic-ai to 1.107.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-107292 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A moderate severity flaw was found in the pydantic-ai development web chat UI (Agent.to_web() and clai web), which ships in Red Hat Enterprise Linux AI and Lightspeed Core container images. The chat server does not validate the HTTP Host header of incoming requests. If a developer who is running this local development…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Binding the development web chat UI to localhost, Origin header checks, and CSRF tokens do not prevent the DNS rebinding attack path. Upstream resolved this issue by validating the Host header and rejecting unexpected hosts; the fix is available in pydantic-ai and pydantic-ai-slim 2.30.0, and in 1.107.5 on the v1 maintenance line.Source: Red Hat security advisory for CVE-2026-107292 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-107292 in your dependencies?
Find it across PyPI, including transitive dependencies.