CVE-2026-54249: Pydantic AI UploadedFile refs leak

CISO Take

Pydantic AI's UI adapters (e.g. the Vercel AI adapter) validate file URLs against a scheme allowlist, but silently forward UploadedFile references — provider file IDs or cloud-storage URIs like s3:// and gs:// — without any check, so the server resolves them using its own IAM role, service account, or provider API key rather than the requesting client's identity. With 501 downstream dependents and this affecting any app built on the framework's chat/message-history handling, the blast radius for multi-tenant SaaS platforms is real: a crafted message history can pull another tenant's file straight out of the app's own storage. That said, exploitation requires guessing or obtaining a valid file identifier, EPSS sits at just 0.00197, there's no public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC call is TRACK — so this is a patch-on-schedule item, not a fire drill. Upgrade to pydantic-ai / pydantic-ai-slim 1.106.0 (or 2.0.0b6 on the beta line) and, in the meantime, audit whether uploaded objects use predictable names that would make identifiers guessable.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Medium risk overall (CVSS 6.8, AC:H). The high attack complexity is the key mitigating factor — an attacker needs a valid, referenceable file identifier (provider file ID or cloud-storage URI), and exploitability hinges entirely on how predictable the target application's object-naming scheme is. Confidentiality impact is high with no integrity or availability effect (C:H/I:N/A:N), and the scope-changed vector (S:C) reflects that the attack pivots from the AI conversation layer into the backend's storage/provider account. No active exploitation signals exist: not in CISA KEV, no public PoC, no Nuclei template, EPSS near-zero, and SSVC=TRACK. In single-tenant deployments the risk is largely self-inflicted (server reads its own files); in multi-tenant SaaS built on pydantic-ai, the same flaw becomes cross-tenant data exposure, which raises the practical severity beyond the raw CVSS score.

How does the attack unfold?

Entry via crafted message history

Attacker submits message history to the pydantic-ai UI adapter (e.g. Vercel AI adapter) containing an UploadedFile reference to a file ID or cloud-storage URI they don't own.

AML.T0049

Server-side resolution bypass

Unlike URL parts, the UploadedFile reference isn't checked against a scheme allowlist, so the framework forwards it to the model provider or cloud storage backend for resolution.

AML.T0080.001

Cross-identity file access

The provider or cloud storage resolves the reference using the application's own IAM role, service account, or API key rather than the client's identity, granting read access regardless of ownership.

Data disclosure

File content is retrieved and surfaced back through the agent's response, exposing data from the application's own account or, in multi-tenant deployments, from another tenant.

AML.T0057

Entry via crafted message history

Attacker submits message history to the pydantic-ai UI adapter (e.g. Vercel AI adapter) containing an UploadedFile reference to a file ID or cloud-storage URI they don't own.

AML.T0049

Server-side resolution bypass

Unlike URL parts, the UploadedFile reference isn't checked against a scheme allowlist, so the framework forwards it to the model provider or cloud storage backend for resolution.

AML.T0080.001

Cross-identity file access

The provider or cloud storage resolves the reference using the application's own IAM role, service account, or API key rather than the client's identity, granting read access regardless of ownership.

Data disclosure

File content is retrieved and surfaced back through the agent's response, exposing data from the application's own account or, in multi-tenant deployments, from another tenant.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Pydantic AI	pip	>= 1.65.0, < 1.106.0	`1.106.0`
20.2K 483 dependents Pushed 5d ago 92% patched ~189d to patch Full package profile →
Pydantic AI	pip	>= 1.65.0, < 1.106.0	`1.106.0`
20.2K 483 dependents Pushed 5d ago 92% patched ~189d to patch Full package profile →

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Changed

C High

I None

A None

What should I do?

1 step

Upgrade to pydantic-ai >= 1.106.0 or pydantic-ai-slim >= 1.106.0 (2.0.0b6 for the 2.0 beta line) immediately — this is the only complete fix. If an immediate upgrade isn't possible: add server-side allowlisting/ownership validation for any UploadedFile reference before resolution (never trust client-supplied provider file IDs or cloud-storage URIs at face value); scope the service account or IAM role used for file resolution to the minimum bucket/prefix needed, with no cross-tenant read access; ensure uploaded object identifiers are non-guessable (random UUIDs, not sequential or predictable names); and add monitoring/alerting on cloud-storage or provider file-access logs for reads that don't correlate with a legitimate upload event from the same session.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Privacy Violation Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0057 - LLM Data Leakage AML.T0080.001 - Thread

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-54249?

Pydantic AI's UI adapters (e.g. the Vercel AI adapter) validate file URLs against a scheme allowlist, but silently forward UploadedFile references — provider file IDs or cloud-storage URIs like s3:// and gs:// — without any check, so the server resolves them using its own IAM role, service account, or provider API key rather than the requesting client's identity. With 501 downstream dependents and this affecting any app built on the framework's chat/message-history handling, the blast radius for multi-tenant SaaS platforms is real: a crafted message history can pull another tenant's file straight out of the app's own storage. That said, exploitation requires guessing or obtaining a valid file identifier, EPSS sits at just 0.00197, there's no public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC call is TRACK — so this is a patch-on-schedule item, not a fire drill. Upgrade to pydantic-ai / pydantic-ai-slim 1.106.0 (or 2.0.0b6 on the beta line) and, in the meantime, audit whether uploaded objects use predictable names that would make identifiers guessable.

Is CVE-2026-54249 actively exploited?

No confirmed active exploitation of CVE-2026-54249 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54249?

Upgrade to pydantic-ai >= 1.106.0 or pydantic-ai-slim >= 1.106.0 (2.0.0b6 for the 2.0 beta line) immediately — this is the only complete fix. If an immediate upgrade isn't possible: add server-side allowlisting/ownership validation for any UploadedFile reference before resolution (never trust client-supplied provider file IDs or cloud-storage URIs at face value); scope the service account or IAM role used for file resolution to the minimum bucket/prefix needed, with no cross-tenant read access; ensure uploaded object identifiers are non-guessable (random UUIDs, not sequential or predictable names); and add monitoring/alerting on cloud-storage or provider file-access logs for reads that don't correlate with a legitimate upload event from the same session.

What systems are affected by CVE-2026-54249?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, UI/chat adapters, cloud storage integrations, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-54249?

CVE-2026-54249 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworksUI/chat adapterscloud storage integrationsmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0057 LLM Data Leakage

AML.T0080.001 Thread

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.

Exploitation Scenario

An attacker with access to a customer-facing chat agent built on pydantic-ai (e.g., via a Vercel AI SDK frontend) crafts a message history payload containing an UploadedFile object that references a file the attacker does not own — either a guessed provider file ID or a cloud-storage URI such as s3://app-bucket/other-tenant/report.pdf. Because the UI adapter validates URL scheme parts but forwards UploadedFile references unchecked, the pydantic-ai backend resolves the reference using its own service credentials rather than the attacker's identity, retrieves the file, and surfaces its content back through the agent's response — exfiltrating data from the application's cloud-storage or model-provider account, potentially belonging to another customer.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.