CVE-2026-48782: Pydantic AI IPv6 Metadata Bypass – Credential Exposure in NAT64 Networks

Technical summary

This vulnerability is an incomplete remediation of GHSA-cqp8-fcvh-x7r3 (CVE-2026-46678), which itself patched CVE-2026-25580. The original fix decoded IPv4-mapped IPv6 addresses (::ffff:a.b.c.d), 6to4 (2002::/16), and the NAT64 well-known prefix (64:ff9b::/96) to prevent access to metadata endpoints. However, several IPv6 transition forms remain unhandled: IPv4-compatible IPv6 (::a.b.c.d), NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64prefixes, and ISATAP. When an attacker-controlled URL is decoded, these unhandled IPv6 wrappers bypass the blocklist and resolve to the underlying IPv4 metadata service (typically 169.254.169.254 in AWS, or similar in other clouds). The attack vector requires network-level routing of these IPv6 forms and relies on applications calling force_download='allow-local' to disable the default private IP block. This affects Pydantic AI versions 1.56.0–1.101.0, 2.0.0b1, and 2.0.0b2.

Business impact

Organizations using Pydantic AI for AI-driven workflows face exposure of short-term cloud IAM credentials if they have enabled local downloads and operate in NAT64 or ISATAP environments. Compromised credentials could allow attackers to assume cloud service roles, access data, modify configurations, or pivot within cloud infrastructure. The risk is primarily relevant to cloud-native deployments: Kubernetes clusters with NAT64 (increasingly common in IPv6-primary environments), dual-stack NAT64 setups, and isolated IPv6 networks. Organizations on standard dual-stack cloud VMs or containers are not practically affected due to lack of routing for these IPv6 forms. However, teams with unclear network topologies or mixed deployment patterns should assume potential exposure if using affected versions.

Affected systems

Pydantic AI versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2 are affected. The issue manifests only when both conditions are met: (1) an application explicitly uses force_download='allow-local' to permit access to internal IP addresses, and (2) the network routes one or more unhandled IPv6 transition forms (NAT64 with RFC 8215 local prefix, NAT64 with custom operator prefixes, ISATAP, or deprecated IPv4-compatible IPv6). Standard dual-stack cloud deployments without NAT64 or ISATAP are not affected in practice. Organizations should audit Pydantic AI usage and verify network configurations to determine exposure.

Exploitability

Exploitation requires an attacker to control a URL that Pydantic AI will download (or a man-in-the-middle position to inject such a URL). The attacker crafts a malicious URL using one of the unhandled IPv6 transition forms to point to the cloud metadata endpoint. When the application processes the URL with force_download='allow-local', the IPv6 wrapper bypasses the metadata blocklist, and the IPv4 metadata endpoint is reached, leaking short-term credentials. The CVSS 3.1 score of 6.8 (MEDIUM, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects network-based attack feasibility, high complexity due to the need for specific network routing and application configuration, and high impact on confidentiality. No user interaction is needed once the application processes the malicious URL. The 'AC:H' component reflects that the attack requires both specific network topology and deliberate use of force_download='allow-local'.

Remediation

Upgrade Pydantic AI to version 2.0.0b3 or later, which correctly decodes and blocks all IPv6 transition forms, including IPv4-compatible IPv6, NAT64 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP. Organizations unable to upgrade immediately should disable force_download='allow-local' and rely on the default blocklist for private/internal IPs. Additionally, review network configurations to identify whether NAT64 or ISATAP transition forms are routed; if they are not, the risk is lower but the upgrade remains advised as a defense-in-depth measure. Teams should audit applications to determine which ones explicitly opt into local downloads and prioritize patches for those components.

Patch guidance

Update Pydantic AI to 2.0.0b3 or any release version after that (verify against Pydantic AI release notes). The patch extends the metadata IP blocklist to include all IPv6 transition forms that could resolve to internal metadata endpoints. Test the patched version in a staging environment that mirrors your production network topology (particularly if using NAT64 or ISATAP) to ensure no unexpected behavior. If running Pydantic AI in containerized or Kubernetes environments, check whether your cluster uses NAT64; if so, prioritize patching. For applications currently using force_download='allow-local', review the security model post-patch and consider whether local downloads remain necessary.

Detection guidance

Monitor outbound connections from Pydantic AI applications to internal IP ranges, especially 169.254.169.254 (AWS metadata) and equivalent ranges in Azure (169.254.169.254) and GCP. Use network observability tools to identify traffic using unhandled IPv6 transition forms (source addresses in 64:ff9b:1::/48, operator NAT64 ranges, ISATAP ::ffff:0:0/96 variants, or ::a.b.c.d). Correlate suspicious metadata access with application logs to confirm if force_download='allow-local' was invoked. Check Pydantic AI version inventory in your environment; prioritize inspection of installations in NAT64-configured networks (check Kubernetes cluster address families, corporate IPv6 infrastructure documentation). Log and alert on any credential leakage or unexpected IAM activity on short-term session tokens.

Why prioritize this

This vulnerability should be addressed promptly if your organization operates in NAT64-configured networks (especially Kubernetes clusters) or uses dual-stack with NAT64 NAT. The incomplete fix to a prior vulnerability suggests systematic risk and potential for future bypasses. However, standard dual-stack cloud deployments face lower practical risk due to lack of IPv6 transition routing. Prioritize based on (1) network topology (NAT64 presence), (2) Pydantic AI usage scope, and (3) current application configuration (whether force_download='allow-local' is actually used). Teams in IPv6-primary or NAT64-heavy environments should treat this as a near-term patch; others may batch it with regular updates.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects a medium-severity vulnerability with network-based attack potential, high-impact credential exposure, but significant complexity barriers. The 'AC:H' rating acknowledges that the attacker must craft IPv6 wrappers that the target network actually routes, and the application must explicitly allow local downloads. The scope change ('S:C') indicates that compromised cloud credentials could affect other systems and services. The high confidentiality impact ('C:H') reflects the exposure of short-term cloud IAM credentials. No integrity or availability impact is assigned because the vulnerability is a disclosure mechanism, not a modification or denial-of-service vector. Organizations should not dismiss this as low-risk merely due to the MEDIUM label; exposure of cloud credentials is a business-critical threat. Contextualize the score within your specific deployment: if you are not in a NAT64 environment and do not use force_download='allow-local', your practical risk is lower.

Frequently asked questions