Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-107288: Pydantic AI can bypass blocked domains via alternate spelling
CVE-2026-107288 · published 10 days ago
Summary
Versions of Pydantic AI from 1.77.0 to 1.107.5 and from 2.0.0 to 2.43.9 may let a malicious model reach a site that should be blocked by using a different spelling of the host name. The check compares the blocked name after normalising it, but an attacker can supply an equivalent Unicode or case‑variant form that resolves to the same address and is not blocked. Update to version 1.107.6 or later, or 2.44.0 or later, to close the bypass.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pydantic | pydantic-ai | >= 1.77.0, < 1.107.6 |
| pydantic | pydantic-ai-slim | >= 1.77.0, < 1.107.6 |
| pydantic | pydantic_ai |
>= 1.77.0, < 1.107.6 >= 2.0.0, < 2.44.0 cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* |
Original advisory text
Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.
References
- https://github.com/pydantic/pydantic-ai/pull/8407 Patch
- https://github.com/pydantic/pydantic-ai/pull/8409 Patch
- https://github.com/pydantic/pydantic-ai/commit/490335f8e2322e143a79337ddca9410e0... Patch
- https://github.com/pydantic/pydantic-ai/commit/a9dab92099d0ef9d5d4aa34ccac8a6f1b... Patch
- https://github.com/pydantic/pydantic-ai/commit/c1f212a084cbfa0012f2044cdb4731d21... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1072... Vendor Advisory
- https://github.com/pydantic/pydantic-ai/pull/8421 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-107288 Vendor Advisory
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0 URL
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j Vendor Advisory
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
CWE-1289Improper Validation of Unsafe Equivalence in Input
Timeline
Published8 Oct 2026
Updated15 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-107288 · NVD
CVE-2026-107288 · MITRE
CVE-2026-107288 · OSV
GHSA-22h6-qm39-v87j · GHSA
Track software like this
Free during beta