All vulnerabilities
CVE-2026-107292GHSA-q2xc-rrxj-58x9PYSEC-2026-4279PYSEC-2026-4288

pydantic-ai: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

pydantic pydantic-aipipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.107.5Also 2.30.0GitHub
Published8 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 1.107.5pydantic-ai, pipGitHub
  • 2.30.0pydantic-ai, pipGitHub
  • 1.107.5pydantic-ai-slim, pipGitHub
  • 2.30.0pydantic-ai-slim, pipGitHub
  • 1.107.5pydantic-ai, PyPIOSVpip install "pydantic-ai>=1.107.5"
  • 2.30.0pydantic-ai, PyPIOSVpip install "pydantic-ai>=2.30.0"
Show all 8 fixed versions
  • 1.107.5pydantic-ai-slim, PyPIOSVpip install "pydantic-ai-slim>=1.107.5"
  • 2.30.0pydantic-ai-slim, PyPIOSVpip install "pydantic-ai-slim>=2.30.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.

Details

Once a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Origin check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.

Binding the web UI to localhost — the default — does not prevent this.

Impact

Applications and developers serving an agent through Agent.to_web() or clai web. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.

Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.

Mitigation

Upgrade to pydantic-ai/pydantic-ai-slim >= 2.30.0, or >= 1.107.5 on the v1 maintenance line.

The fix validates the Host header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding 421 Misdirected Request otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:

app = agent.to_web(allowed_hosts=['ui.example.com'])

Text from GitHub Advisory Database

Affected versions 194

  • pydantic-ai, pip>= 1.34.0, < 1.107.5GitHub
  • pydantic-ai, pip>= 2.0.0b1, < 2.30.0GitHub
  • pydantic-ai-slim, pip>= 1.34.0, < 1.107.5GitHub
  • pydantic-ai-slim, pip>= 2.0.0b1, < 2.30.0GitHub
  • pydantic-aiaffected: >= 1.34.0, < 2.0.0b1CVE List
  • pydantic-aiaffected: >= 2.0.0b1, < 2.30.0CVE List
  • pydantic-ai-slimaffected: >= 1.34.0, < 2.0.0b1CVE List
  • pydantic-ai-slimaffected: >= 2.0.0b1, < 2.30.0CVE List
  • pydantic-ai, PyPIfrom 1.34.0, fixed in 1.107.5OSV
  • pydantic-ai, PyPI1.100.0OSV
  • pydantic-ai, PyPI1.101.0OSV
  • pydantic-ai, PyPI1.102.0OSV
  • pydantic-ai, PyPI1.103.0OSV
  • pydantic-ai, PyPI1.104.0OSV
  • pydantic-ai, PyPI1.105.0OSV
  • pydantic-ai, PyPI1.106.0OSV
  • pydantic-ai, PyPI1.107.0OSV
  • pydantic-ai, PyPI1.107.1OSV
  • pydantic-ai, PyPI1.107.2OSV
  • pydantic-ai, PyPI1.107.4OSV
  • pydantic-ai, PyPI1.34.0OSV
  • pydantic-ai, PyPI1.35.0OSV
  • pydantic-ai, PyPI1.36.0OSV
  • pydantic-ai, PyPI1.37.0OSV
  • pydantic-ai, PyPI1.38.0OSV
  • pydantic-ai, PyPI1.39.0OSV
  • pydantic-ai, PyPI1.39.1OSV
  • pydantic-ai, PyPI1.40.0OSV
  • pydantic-ai, PyPI1.41.0OSV
  • pydantic-ai, PyPI1.42.0OSV
  • pydantic-ai, PyPI1.43.0OSV
  • pydantic-ai, PyPI1.44.0OSV
  • pydantic-ai, PyPI1.46.0OSV
  • pydantic-ai, PyPI1.47.0OSV
  • pydantic-ai, PyPI1.48.0OSV
  • pydantic-ai, PyPI1.49.0OSV
  • pydantic-ai, PyPI1.50.0OSV
  • pydantic-ai, PyPI1.51.0OSV
  • pydantic-ai, PyPI1.52.0OSV
  • pydantic-ai, PyPI1.53.0OSV
  • pydantic-ai, PyPI1.54.0OSV
  • pydantic-ai, PyPI1.55.0OSV
  • pydantic-ai, PyPI1.56.0OSV
  • pydantic-ai, PyPI1.57.0OSV
  • pydantic-ai, PyPI1.58.0OSV
  • pydantic-ai, PyPI1.59.0OSV
  • pydantic-ai, PyPI1.60.0OSV
  • pydantic-ai, PyPI1.61.0OSV
  • pydantic-ai, PyPI1.62.0OSV
  • pydantic-ai, PyPI1.63.0OSV
  • pydantic-ai, PyPI1.64.0OSV
  • pydantic-ai, PyPI1.65.0OSV
  • pydantic-ai, PyPI1.66.0OSV
  • pydantic-ai, PyPI1.67.0OSV
  • pydantic-ai, PyPI1.68.0OSV
  • pydantic-ai, PyPI1.69.0OSV
  • pydantic-ai, PyPI1.70.0OSV
  • pydantic-ai, PyPI1.71.0OSV
  • pydantic-ai, PyPI1.72.0OSV
  • pydantic-ai, PyPIfrom 2.0.0b1, fixed in 2.30.0OSV
  • pydantic-ai, PyPI2.0.0OSV
  • pydantic-ai, PyPI2.0.0b1OSV
  • pydantic-ai, PyPI2.0.0b2OSV
  • pydantic-ai, PyPI2.0.0b3OSV
  • pydantic-ai, PyPI2.0.0b4OSV
  • pydantic-ai, PyPI2.0.0b5OSV
  • pydantic-ai, PyPI2.0.0b6OSV
  • pydantic-ai, PyPI2.0.0b7OSV
  • pydantic-ai, PyPI2.1.0OSV
  • pydantic-ai, PyPI2.10.0OSV
  • pydantic-ai, PyPI2.11.0OSV
  • pydantic-ai, PyPI2.12.0OSV
  • pydantic-ai, PyPI2.13.0OSV
  • pydantic-ai, PyPI2.14.0OSV
  • pydantic-ai, PyPI2.14.1OSV
  • pydantic-ai, PyPI2.15.0OSV
  • pydantic-ai, PyPI2.16.0OSV
  • pydantic-ai, PyPI2.17.0OSV
  • pydantic-ai, PyPI2.18.0OSV
  • pydantic-ai, PyPI2.19.0OSV
  • pydantic-ai, PyPI2.2.0OSV
  • pydantic-ai, PyPI2.20.0OSV
  • pydantic-ai, PyPI2.21.0OSV
  • pydantic-ai, PyPI2.22.0OSV
  • pydantic-ai, PyPI2.23.0OSV
  • pydantic-ai, PyPI2.24.0OSV
  • pydantic-ai, PyPI2.25.0OSV
  • pydantic-ai, PyPI2.26.0OSV
  • pydantic-ai, PyPI2.27.0OSV
  • pydantic-ai, PyPI2.27.1OSV
  • pydantic-ai, PyPI2.28.0OSV
  • pydantic-ai, PyPI2.29.0OSV
  • pydantic-ai, PyPI2.3.0OSV
  • pydantic-ai, PyPI2.4.0OSV
  • pydantic-ai, PyPI2.5.0OSV
  • pydantic-ai, PyPI2.5.1OSV
  • pydantic-ai, PyPI2.6.0OSV
  • pydantic-ai, PyPI2.7.0OSV
  • pydantic-ai, PyPI2.8.0OSV
  • pydantic-ai, PyPI2.9.0OSV
  • pydantic-ai, PyPI2.9.1OSV
  • pydantic-ai-slim, PyPIfrom 1.34.0, fixed in 1.107.5OSV
  • pydantic-ai-slim, PyPI1.100.0OSV
  • pydantic-ai-slim, PyPI1.101.0OSV
  • pydantic-ai-slim, PyPI1.102.0OSV
  • pydantic-ai-slim, PyPI1.103.0OSV
  • pydantic-ai-slim, PyPI1.104.0OSV
  • pydantic-ai-slim, PyPI1.105.0OSV
  • pydantic-ai-slim, PyPI1.106.0OSV
  • pydantic-ai-slim, PyPI1.107.0OSV
  • pydantic-ai-slim, PyPI1.107.1OSV
  • pydantic-ai-slim, PyPI1.107.2OSV
  • pydantic-ai-slim, PyPI1.107.4OSV
  • pydantic-ai-slim, PyPI1.34.0OSV
  • pydantic-ai-slim, PyPI1.35.0OSV
  • pydantic-ai-slim, PyPI1.36.0OSV
  • pydantic-ai-slim, PyPI1.37.0OSV
  • pydantic-ai-slim, PyPI1.38.0OSV
  • pydantic-ai-slim, PyPI1.39.0OSV
  • pydantic-ai-slim, PyPI1.39.1OSV
  • pydantic-ai-slim, PyPI1.40.0OSV
  • pydantic-ai-slim, PyPI1.41.0OSV
  • pydantic-ai-slim, PyPI1.42.0OSV
  • pydantic-ai-slim, PyPI1.43.0OSV
  • pydantic-ai-slim, PyPI1.44.0OSV
  • pydantic-ai-slim, PyPI1.46.0OSV
  • pydantic-ai-slim, PyPI1.47.0OSV
  • pydantic-ai-slim, PyPI1.48.0OSV
  • pydantic-ai-slim, PyPI1.49.0OSV
  • pydantic-ai-slim, PyPI1.50.0OSV
  • pydantic-ai-slim, PyPI1.51.0OSV
  • pydantic-ai-slim, PyPI1.52.0OSV
  • pydantic-ai-slim, PyPI1.53.0OSV
  • pydantic-ai-slim, PyPI1.54.0OSV
  • pydantic-ai-slim, PyPI1.55.0OSV
  • pydantic-ai-slim, PyPI1.56.0OSV
  • pydantic-ai-slim, PyPI1.57.0OSV
  • pydantic-ai-slim, PyPI1.58.0OSV
  • pydantic-ai-slim, PyPI1.59.0OSV
  • pydantic-ai-slim, PyPI1.60.0OSV
  • pydantic-ai-slim, PyPI1.61.0OSV
  • pydantic-ai-slim, PyPI1.62.0OSV
  • pydantic-ai-slim, PyPI1.63.0OSV
  • pydantic-ai-slim, PyPI1.64.0OSV
  • pydantic-ai-slim, PyPI1.65.0OSV
  • pydantic-ai-slim, PyPI1.66.0OSV
  • pydantic-ai-slim, PyPI1.67.0OSV
  • pydantic-ai-slim, PyPI1.68.0OSV
  • pydantic-ai-slim, PyPI1.69.0OSV
  • pydantic-ai-slim, PyPI1.70.0OSV
  • pydantic-ai-slim, PyPI1.71.0OSV
  • pydantic-ai-slim, PyPI1.72.0OSV
  • pydantic-ai-slim, PyPIfrom 2.0.0b1, fixed in 2.30.0OSV
  • pydantic-ai-slim, PyPI2.0.0OSV
  • pydantic-ai-slim, PyPI2.0.0b1OSV
  • pydantic-ai-slim, PyPI2.0.0b2OSV
  • pydantic-ai-slim, PyPI2.0.0b3OSV
  • pydantic-ai-slim, PyPI2.0.0b4OSV
  • pydantic-ai-slim, PyPI2.0.0b5OSV
  • pydantic-ai-slim, PyPI2.0.0b6OSV
  • pydantic-ai-slim, PyPI2.0.0b7OSV
  • pydantic-ai-slim, PyPI2.1.0OSV
  • pydantic-ai-slim, PyPI2.10.0OSV
  • pydantic-ai-slim, PyPI2.11.0OSV
  • pydantic-ai-slim, PyPI2.12.0OSV
  • pydantic-ai-slim, PyPI2.13.0OSV
  • pydantic-ai-slim, PyPI2.14.0OSV
  • pydantic-ai-slim, PyPI2.14.1OSV
  • pydantic-ai-slim, PyPI2.15.0OSV
  • pydantic-ai-slim, PyPI2.16.0OSV
  • pydantic-ai-slim, PyPI2.17.0OSV
  • pydantic-ai-slim, PyPI2.18.0OSV
  • pydantic-ai-slim, PyPI2.19.0OSV
  • pydantic-ai-slim, PyPI2.2.0OSV
  • pydantic-ai-slim, PyPI2.20.0OSV
  • pydantic-ai-slim, PyPI2.21.0OSV
  • pydantic-ai-slim, PyPI2.22.0OSV
  • pydantic-ai-slim, PyPI2.23.0OSV
  • pydantic-ai-slim, PyPI2.24.0OSV
  • pydantic-ai-slim, PyPI2.25.0OSV
  • pydantic-ai-slim, PyPI2.26.0OSV
  • pydantic-ai-slim, PyPI2.27.0OSV
  • pydantic-ai-slim, PyPI2.27.1OSV
  • pydantic-ai-slim, PyPI2.28.0OSV
  • pydantic-ai-slim, PyPI2.29.0OSV
  • pydantic-ai-slim, PyPI2.3.0OSV
  • pydantic-ai-slim, PyPI2.4.0OSV
  • pydantic-ai-slim, PyPI2.5.0OSV
  • pydantic-ai-slim, PyPI2.5.1OSV
  • pydantic-ai-slim, PyPI2.6.0OSV
  • pydantic-ai-slim, PyPI2.7.0OSV
  • pydantic-ai-slim, PyPI2.8.0OSV
  • pydantic-ai-slim, PyPI2.9.0OSV
  • pydantic-ai-slim, PyPI2.9.1OSV

References 8