{"id":"CVE-2026-54249","kind":"vulnerability","aliases":["CVE-2026-54249","GHSA-h7p7-w5gc-xj3w"],"related":[],"title":"Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials","description":"### Summary\n\nA client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.\n\n### Details\n\nUI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.\n\nBecause the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.\n\n### Impact\n\nApplications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.\n\n### Patches\n\nUpgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` references on client-submitted messages the same way file URLs are validated.\n\n### Workarounds\n\nIf users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.","summary":"Pydantic AI UI adapters forward client-submitted UploadedFile references (provider file IDs or s3:// and gs:// URIs) to the model provider without validation. An attacker who can submit message history can make the server's own credentials fetch files the attacker should not read.","severity":"medium","cvss":6.800000190734863,"epss":0.0031500000040978193,"exploited":false,"exploited_at":null,"products":[{"name":"pydantic-ai-slim","fixed":["1.106.0"],"affected":">= 1.65.0, < 1.106.0","ecosystem":"pypi"},{"name":"pydantic-ai-slim","fixed":["2.0.0b6"],"affected":">= 2.0.0b1, < 2.0.0b6","ecosystem":"pypi"},{"name":"pydantic-ai","fixed":["1.106.0"],"affected":">= 1.65.0, < 1.106.0","ecosystem":"pypi"},{"name":"pydantic-ai","fixed":["2.0.0b6"],"affected":">= 2.0.0b1, < 2.0.0b6","ecosystem":"pypi"},{"name":"pydantic ai","fixed":["1.105.0"],"affected":">= 1.65.0, < 1.105.0","ecosystem":"vendor"},{"name":"pydantic ai","fixed":[],"affected":"= 2.0.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","cloud-storage","cwe-918","model-provider","pydantic-ai","python","vercel-ai-adapter"],"not_affected_if":["default-config","no-ui-adapter","trusted-message-history"],"how_to_check":"Check the pydantic-ai-slim or pydantic-ai version in the lockfile or pip freeze; affected if >=1.65.0 <1.106.0 or >=2.0.0b1 <2.0.0b6.","fix":"Upgrade pydantic-ai-slim and pydantic-ai to 1.106.0 (1.x line) or 2.0.0b6 (2.x beta line).\nIf upgrade is not possible, stop passing untrusted client message history to the agent or strip UploadedFile parts from incoming messages.","status":"open","published_at":"2026-07-29T21:17:47+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T21:46:03+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T21:46:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade pydantic-ai-slim and pydantic-ai to 1.106.0 (1.x line) or 2.0.0b6 (2.x beta line).\nIf upgrade is not possible, stop passing untrusted client message history to the agent or strip UploadedFile parts from incoming messages.","reach":"internet","impact":"medium","summary":"Pydantic AI UI adapters forward client-submitted UploadedFile references (provider file IDs or s3:// and gs:// URIs) to the model provider without validation. An attacker who can submit message history can make the server's own credentials fetch files the attacker should not read.","category":"ai-tooling","who_cares":["pydantic-ai","python","vercel-ai-adapter","cloud-storage","model-provider"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Server reads provider or cloud-storage files using the application's own credentials.","analyst_note":"","how_to_check":"Check the pydantic-ai-slim or pydantic-ai version in the lockfile or pip freeze; affected if >=1.65.0 <1.106.0 or >=2.0.0b1 <2.0.0b6.\nunknown","needs_analyst":false,"not_affected_if":["default-config","no-ui-adapter","trusted-message-history"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000589,"input_tokens":3464,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A '-54249':22A,30A '-918':56B '1':333C '1.106.0':332C '2':339C '2.0.0':336C 'access':14A,170C 'account':141C,241C,274C 'adapt':8A,67B,71B,125C,174C,299C,305C 'agent':295C,375C,386C 'ai':2A,33A,37A,41A,44A,46A,48A,50B,62B,66B,69B,123C,304C 'ai-tool':49B 'allow':9A,160C 'allowlist':199C 'alway':327C 'api':244C 'applic':17A,132C,284C,320C 'arbitrari':128C 'attack':92B,108B,260C,309C 'attacker-chosen':259C 'b6':337C 'belong':270C 'beta':341C 'cannot':362C 'caus':264C 'chosen':261C 'client':74B,114C,162C,180C,249C,252C,289C,349C,369C 'client-submit':73B,179C,288C,348C,368C 'cloud':53B,139C,217C 'cloud-storag':52B,138C,216C 'contain':257C 'craft':254C 'credenti':19A,104B,159C 'cve':20A,28A 'cwe':55B 'depend':316C 'detail':172C 'e.g':220C 'exploit':306C 'fetch':105B,152C 'file':13A,79B,106B,129C,165C,176C,191C,210C,213C,314C,355C 'forward':72B,144C,185C,202C,223C 'ghsa':24A 'ghsa-h7p7-w5gc-xj3w':23A 'given':279C 'h7p7':25A 'histori':97B,119C,183C,256C,292C,372C 'iam':238C 'id':80B,214C 'ident':237C 'identifi':282C,315C,324C 'impact':283C 'incom':381C 'key':245C 'line':342C 'make':99B 'messag':96B,118C,182C,255C,291C,351C,371C,382C 'model':58B,87B,135C,149C,189C 'model-provid':57B,134C 'name':321C 'object':269C,322C 'part':177C,193C,379C 'pass':286C,366C 'patch':329C 'point':207C 'provid':59B,78B,88B,136C,150C,190C,212C,228C,243C 'pydant':1A,61B,68B,122C 'pydantic':32A,36A,40A,43A,45A,47A 'pydantic-ai':39A,42A,60B 'pydantic-ai-slim':31A,35A 'python':63B 'rather':246C 'read':111B,164C,268C 'reconstruct':175C 'refer':5A,77B,127C,146C,205C,311C,346C 'referenc':281C 'requir':307C 'resolv':229C 'role':239C 'run':384C 's3':82B,221C 'scheme':198C 'server':11A,101B,143C,156C,235C,266C 'server-sid':10A,234C 'servic':240C 'side':12A,236C 'slim':34A,38A 'storag':54B,140C,218C 'strip':377C 'submit':75B,95B,117C,181C,290C,350C,370C 'summari':112C 'tenant':278C 'tool':51B 'ui':7A,70B,124C,173C,298C 'unguess':328C 'untrust':287C,367C 'unvalid':3A 'upgrad':330C,363C 'uploadedfil':4A,76B,204C,231C,262C,345C,378C 'uri':84B,219C 'url':192C,356C 'use':15A,154C,232C 'user':361C 'valid':90B,195C,225C,313C,344C,358C 'vercel':65B,303C 'vercel-ai-adapt':64B 'w5gc':26A 'way':354C 'without':89B,224C 'workaround':359C 'x':334C,340C 'xj3w':27A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-29T21:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h7p7-w5gc-xj3w","url":"https://github.com/advisories/GHSA-h7p7-w5gc-xj3w","severity":"medium","published_at":"2026-08-13T14:16:26+00:00","modified_at":"2026-10-22T08:27:23+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54249","severity":null,"published_at":"2026-07-29T21:17:47+00:00","modified_at":"2026-08-04T13:22:03+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}