« Volver al listado

CVE-2026-107292

Estado: AnalizadaMedia (6.4)—

Pydantic AI es un framework de agentes en Python para crear aplicaciones y flujos de trabajo con IA generativa. Desde la 1.34.0 hasta la 2.30.0, el servidor de chat de desarrollo web de Agent.to_web() y clai no valida la cabecera Host, lo que permite a un sitio web visitado por un desarrollador utilizar DNS rebinding para llegar a un agente alojado en loopback como un servicio del mismo origen.

Leer descripción completaMostrar menos

La página hostil puede leer la interfaz servida y enviar solicitudes de chat que ejecuten herramientas del agente con los privilegios y credenciales del proceso local, provocando la divulgación de datos o efectos secundarios no deseados. Vincularse a localhost, las comprobaciones de Origin y los tokens CSRF no impiden la ruta de DNS rebinding del mismo origen. Este problema está corregido en las versiones 1.107.5 y 2.30.0.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS requiere interacción del usuario (UI:R) y acceso remoto (AV:N). DNS rebinding en navegador del desarrollador visitando sitio hostil ejecuta herramientas del agente local con privilegios del proceso, permitiendo lectura de datos (C:L) y ejecución de comandos indirecta (I:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementRestrict Web-Based ContentPrivileged Account ManagementOperating System ConfigurationLimit Software InstallationExecution Prevention

Tecnologías afectadas (1)

Pydantic — Pydantic AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-107292",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107292",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T01:00:57.093893Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pydantic",
          "product": "pydantic-ai",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 2.0.0b1"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.30.0"
            }
          ]
        },
        {
          "vendor": "pydantic",
          "product": "pydantic-ai-slim",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 2.0.0b1"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.30.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T17:17:14.770",
  "references": [
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7437",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7438",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-350"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0."
    }
  ],
  "lastModified": "2026-10-14T01:17:05.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2156E022-D460-4CBD-8489-7E4F73588C8C",
              "versionEndExcluding": "1.107.5",
              "versionStartIncluding": "1.34.0"
            },
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C634A8A-B96C-4413-B2EB-9B6E218DF5BC",
              "versionEndExcluding": "2.30.0",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}