CVE-2026-46678

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.56.0 through 1.98.0

Description When an application disables the default block on private or internal IPs by setting the force download variable to 'allow-local', the cloud-metadata blocklist can be bypassed. This occurs by encoding the metadata IP in IPv6 transition forms, such as IPv4-mapped IPv6, 6to4, or NAT64. On dual-stack or translated networks, these wrappers route to the underlying IPv4 endpoint, potentially exposing cloud IAM short-term credentials. This issue specifically affects applications that use FileUrl (including ImageUrl, AudioUrl, VideoUrl, and DocumentUrl) with force download='allow-local' on URLs influenced by untrusted input.

Recommendations Upgrade to version 1.99.0 or later. As a temporary workaround, avoid passing force download='allow-local' on any URL that could be influenced by untrusted input. If force download='allow-local' must be used, resolve the hostname and validate the result against a metadata blocklist that includes IPv6-encoded forms before constructing the FileUrl.