« Back to list

CVE-2026-107292

Status: AnalyzedMedium (6.4)—

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector CVSS requiere interacción del usuario (UI:R) y acceso remoto (AV:N). DNS rebinding en navegador del desarrollador visitando sitio hostil ejecuta herramientas del agente local con privilegios del proceso, permitiendo lectura de datos (C:L) y ejecución de comandos indirecta (I:H).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

User Account ManagementRestrict Web-Based ContentPrivileged Account ManagementOperating System ConfigurationLimit Software InstallationExecution Prevention

Affected technologies (1)

Pydantic — Pydantic AI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-107292",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107292",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T01:00:57.093893Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pydantic",
          "product": "pydantic-ai",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 2.0.0b1"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.30.0"
            }
          ]
        },
        {
          "vendor": "pydantic",
          "product": "pydantic-ai-slim",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 2.0.0b1"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.30.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T17:17:14.770",
  "references": [
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7437",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7438",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-350"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0."
    }
  ],
  "lastModified": "2026-10-14T01:17:05.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2156E022-D460-4CBD-8489-7E4F73588C8C",
              "versionEndExcluding": "1.107.5",
              "versionStartIncluding": "1.34.0"
            },
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C634A8A-B96C-4413-B2EB-9B6E218DF5BC",
              "versionEndExcluding": "2.30.0",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}