CVE-2026-107292— Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Quick assessment
Affected
pydantic pydantic-ai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pydantic AI 是一个用于通过生成式 AI 构建应用程序和工作流的 Python 代理框架。在版本 1.34.0 至 2.30.0 之间， 方法和 CLI Web 开发聊天服务器未对 HTTP Host 头部进行校验，从而允许开发人员访问的恶意网站利用 DNS 重绑定（DNS rebinding）技术，将本地回环地址（localhost）上运行的代理伪装成同源服务（same-origin service）进行访问。 恶意网页可以读取服务器返回的 UI 内容，并提交聊天请求，从而以本地进程的权限和凭据执行代理
Possible ATT&CK Techniques 3 AI
T1048 · Exfiltration Over Alternative Protocol T1059 · Command and Scripting Interpreter T1557 · Adversary-in-the-MiddleAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pydantic | pydantic-ai | >= 1.34.0, < 2.0.0b1 |
affected |
>= 2.0.0b1, < 2.30.0 |
affected | ||
| pydantic | pydantic-ai-slim | >= 1.34.0, < 2.0.0b1 |
affected |
>= 2.0.0b1, < 2.30.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107292
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Source: CVE Program / CVE List V5
Vulnerability Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pydantic | pydantic-ai | >= 1.34.0, < 2.0.0b1 | - |
|
| pydantic | pydantic-ai-slim | >= 1.34.0, < 2.0.0b1 | - |
|
II. Public POCs for CVE-2026-107292
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107292
请登录查看更多情报信息。
Other References for CVE-2026-107292 (6)
-
-
-
-
🔗 Release v1.107.5 (2026-08-13) · pydantic/pydantic-ai · GitHub x_refsource_MISC
-
-
Same Patch Batch · pydantic · 2026-10-08 · 10 CVEs total
| CVE-2026-107295 | 7.6 HIGH | `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that ca |
| CVE-2026-107286 | 7.5 HIGH | Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends e |
| CVE-2026-107289 | 6.8 MEDIUM | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix |
| CVE-2026-107287 | 6.5 MEDIUM | Pydantic AI: Excessive resource use when local web fetching converts nested HTML |
| CVE-2026-107290 | 6.5 MEDIUM | Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` |
| CVE-2026-107294 | 6.5 MEDIUM | Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl |
| CVE-2026-107288 | 3.7 LOW | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes |
| CVE-2026-107291 | 2.3 LOW | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans in |
| CVE-2026-107293 | 2.3 LOW | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `incl |
IV. Related Vulnerabilities
Same product: pydantic-ai
-
CVE-2026-107295
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple -
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote co -
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt cont -
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events -
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extractio
Same vendor: pydantic
-
CVE-2026-107295
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple -
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote co -
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt cont -
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events -
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extractio
Same weakness: CWE-346
-
CVE-2026-104659
Origin Validation Error in hMailServer -
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated -
CVE-2026-107230
AsyncHttpClient: Pooled connections can still be shared acro -
CVE-2026-105783
Joplin Web Clipper pairing allows cross-origin theft of a pe -
CVE-2026-105396
Heym before v0.0.112 HITL Review Token Leak via Spoofable Or
V. Comments for CVE-2026-107292
No comments yet