Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

CVE-2026-54249 — pydantic-ai-slim

MEDIUM

CVE-2026-54249 is a medium-severity (CVSS 6.8) Server-Side Request Forgery (SSRF) vulnerability in pydantic-ai-slim. A fix is available for pydantic-ai-slim — see the affected versions and patch details below.

VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Also known asGHSA-h7p7-w5gc-xj3wPYSEC-2026-3692PYSEC-2026-3693
Published
Jul 29, 2026
Updated
Aug 19, 2026
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Sep 27, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-54249.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs22th percentile — riskier than 22% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-54249 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 380,066 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

4 pkgs affected
🐍pydantic-ai-slim🐍pydantic-ai-slim🐍pydantic-ai🐍pydantic-ai

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.

Details

UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File URL parts are validated against a scheme allowlist before being forwarded, but UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation.

Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen UploadedFile can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.

Impact

Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.

Patches

Upgrade to 1.106.0 (1.x) or 2.0.0b6 (the 2.x beta line), which validate UploadedFile references on client-submitted messages the same way file URLs are validated.

Workarounds

If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip UploadedFile parts from incoming messages before running the agent.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIpydantic-ai-slim≥ 1.65.0&&< 1.106.01.106.0pip install --upgrade 'pydantic-ai-slim==1.106.0'
🐍PyPIpydantic-ai-slim≥ 2.0.0b1&&< 2.0.0b62.0.0b6pip install --upgrade 'pydantic-ai-slim==2.0.0b6'
🐍PyPIpydantic-ai≥ 1.65.0&&< 1.106.01.106.0pip install --upgrade 'pydantic-ai==1.106.0'
🐍PyPIpydantic-ai≥ 2.0.0b1&&< 2.0.0b62.0.0b6pip install --upgrade 'pydantic-ai==2.0.0b6'

Affected Products

1 product · 6 configurations
Application
pydantic aipydantic
≥ 1.65.0 && < 1.105.0
1 version
2.0.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pydantic-ai-slim, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update pydantic-ai-slim to 1.106.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54249 is resolved across your whole dependency graph.

  3. Workarounds

    Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

### Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to. ### Details UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which poi
O3 Security · Impact-Aware SCA

Is CVE-2026-54249 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-54249: pydantic-ai (Medium 6.8) | O3 Security