CVE-2026-107292: Pydantic AI Web Chat UI Host Header Validation Vulnerability
Summary
CVE-2026-107292: The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. Affects pydantic-ai across 2 version ranges.
>= 1.34.0, < 1.107.5
>= 2.0.0b1, < 2.30.0
Fixed in 1.107.5 or 2.30.0, depending on the release line you run. How to fix ↓
Also tracked for
- pydantic-ai-slim · PyPI
The same CVE-2026-107292 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic AI is a Python library designed for data validation and settings management using Python type annotations. It is widely used for building data-driven applications. The library includes a web chat UI feature that allows developers to serve agents through the Agent.to_web() method or the clai web command. However, a significant vulnerability exists in the way this feature handles incoming requests, specifically concerning the validation of the Host header.
Vulnerability Detail
The vulnerability arises from the Pydantic AI web chat UI not validating the Host header of incoming requests. This oversight allows an attacker to exploit DNS rebinding techniques, making requests to the chat UI appear as same-origin to the browser. As a result, the served agent can execute with the privileges of the local process, leading to potential data disclosure and unwanted tool effects. Current browser protections are insufficient to mitigate this risk, as they do not cover all scenarios, particularly in top-level navigations.
How To Fix
Latest published version: 2.60.0 as of 23 Oct 2026
pip install --upgrade "pydantic-ai==2.60.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.34.0, < 1.107.51.107.5pip install --upgrade "pydantic-ai==1.107.5" -
>= 2.0.0b1, < 2.30.02.30.0pip install --upgrade "pydantic-ai==2.30.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to bind the web UI to localhost and restrict access to trusted networks. However, this does not fully mitigate the risk. It is recommended to implement the allowed hosts feature as soon as possible.
Conclusion
In summary, the Pydantic AI web chat UI is vulnerable due to improper validation of the Host header, which can lead to serious security risks. It is crucial for developers to upgrade to the patched versions of the library and implement appropriate host validation to safeguard their applications.
See every vulnerability recorded for pydantic-ai →
FAQ
The vulnerability involves the lack of validation for the Host header in requests to the Pydantic AI web chat UI, allowing potential exploitation through DNS rebinding.
Developers and applications using the Pydantic AI web chat UI feature are at risk, particularly those who expose agents through Agent.to_web() or clai web.
Consequences may include data disclosure and unauthorized execution of tools with local process privileges, depending on the capabilities of the served agent.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic-ai.
