Pydantic AI SSRF Cloud Metadata Blocklist Bypass via IPv6 Transition Addressing

Technical Analysis

The vulnerability is an incomplete fix (regression of GHSA-2jrp-274c-jhv3) in Pydantic AI's URL-fetching logic used when processing FileUrl/ImageUrl/AudioUrl/VideoUrl/DocumentUrl objects with force_download='allow-local'. The blocklist checks literal IPv4 representations of known cloud metadata addresses (e.g., 169.254.169.254) but does not normalize or detect equivalent IPv6 transition-form encodings (IPv4-mapped ::ffff:169.254.169.254, 6to4 2002::, or NAT64 well-known prefix forms), allowing an attacker to smuggle a metadata-service request past the filter. The entry point is any untrusted-input-derived URL passed into an agent's document/image/audio ingestion pipeline when the host application has disabled the default private-IP block. Exploitation crosses from the LLM/agent tool layer into the underlying cloud infrastructure trust boundary, letting an attacker exfiltrate IAM short-term credentials (e.g., AWS/GCP/Azure instance metadata tokens) and potentially pivot to broader cloud account compromise. Bundled integrations (Agent.to_web, VercelAIAdapter, AGUIAdapter) are not affected since they don't propagate force_download from external input, narrowing the practical blast radius to custom applications that explicitly configure this unsafe mode.

Affected Systems

Pydantic AI

Detection Signatures

• Outbound requests from agent/file-fetch code to addresses matching IPv4-mapped IPv6 (::ffff:169.254.169.254), 6to4 (2002:a9fe:a9fe::), or NAT64 well-known prefix (64:ff9b::169.254.169.254) forms of cloud metadata IPs
• Application logs showing force_download='allow-local' configured on URL fields sourced from user/LLM-controlled input
• Unexpected HTTP requests to instance metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200) originating from document/image ingestion code paths
• Egress traffic to link-local or metadata-reserved ranges encoded via IPv6 tunneling prefixes

Remediation Steps

1. 1

   Upgrade Pydantic AI

   Update to Pydantic AI version 1.99.0 or later, which fixes the IPv6 transition-form blocklist bypass.

2. 2

   Avoid allow-local for untrusted URLs

   Do not set force_download='allow-local' on FileUrl/ImageUrl/AudioUrl/VideoUrl/DocumentUrl fields whose values are influenced by untrusted or external input; restrict this mode to developer-controlled URLs only.

3. 3

   Network-layer egress controls

   Enforce network-level blocking of requests to cloud metadata IP ranges (including all IPv6 transition encodings) at the host/container/VPC level, independent of application-layer filtering, e.g. via IMDSv2 enforcement, metadata service firewalling, or hop-limit restrictions.

4. 4

   Disable or restrict IPv6/dual-stack where unnecessary

   If dual-stack or NAT64 networking is not required, disable IPv6 or restrict transition mechanisms to reduce the attack surface for address-encoding bypass techniques.

5. 5

   Least-privilege IAM for agent workloads

   Minimize the scope and lifetime of IAM roles attached to instances/containers running agent workloads so that even if metadata credentials are exfiltrated, the resulting access is limited.