CVE-2026-54249: Server-Side Request Forgery via Confused Deputy in Pydantic AI UI Adapters

Vulnerability ID: CVE-2026-54249
CVSS Score: 6.8
Published: 2026-08-13

A Server-Side Request Forgery (SSRF) / Confused Deputy vulnerability has been identified in Pydantic AI UI Adapters (such as VercelAIAdapter). Under certain conditions, a malicious client can supply manipulated message history with provider metadata that forces the server to resolve files within privileged cloud environments (AWS S3, Google Cloud Storage) or model providers. This occurs because the adapters deserialize client-provided metadata structures directly into UploadedFile instances without validation, which are subsequently fetched using high-privilege server credentials.

TL;DR

A Confused Deputy SSRF vulnerability in Pydantic AI UI adapters allows remote, unauthenticated attackers to retrieve and exfiltrate private cloud storage files by injecting manipulated metadata structures into client-submitted message histories.

Technical Details

• CWE ID: CWE-918
• Attack Vector: Network
• CVSS v3.1 Score: 6.8
• EPSS Score: 0.00197
• Impact: Partial Confidentiality Loss (High)
• Exploit Status: none
• KEV Status: Not Listed

Affected Systems

• Pydantic AI UI Adapters (VercelAIAdapter, AGUIAdapter)
• pydantic-ai: >= 1.65.0, < 1.106.0 (Fixed in: 1.106.0)
• pydantic-ai-slim: >= 1.65.0, < 1.106.0 (Fixed in: 1.106.0)
• pydantic-ai: >= 2.0.0b1, < 2.0.0b6 (Fixed in: 2.0.0b6)

Code Analysis

Commit: d280f84

Fix Confused Deputy / SSRF vulnerability by implementing default-safe message sanitization in UI adapters.

Mitigation Strategies

• Upgrade Pydantic AI dependencies to v1.106.0 or v2.0.0b6.
• Ensure preserve_file_data is left at its default value of False.
• Enforce Least Privilege IAM roles on resources processing model agent workloads.

Remediation Steps:

1. Identify all deployment pipelines referencing pydantic-ai or pydantic-ai-slim.
2. Update requirements files (requirements.txt, pyproject.toml, Pipfile) to target >=1.106.0 or >=2.0.0b6.
3. Deploy the updated application and monitor server logs for UserWarning messages from pydantic_ai.ui._adapter.
4. Review the permissions of AWS IAM roles or GCP service accounts assigned to the application servers and restrict access to private buckets.

References

• GitHub Security Advisory GHSA-h7p7-w5gc-xj3w
• NVD - CVE-2026-54249
• CVE.org - CVE-2026-54249
• Pydantic AI Release v1.106.0
• Pydantic AI Release v2.0.0b6

Read the full report for CVE-2026-54249 on our website for more details including interactive diagrams and full exploit analysis.