NVD Published Date: Oct 09, 2026
Preface: Is Pydantic AI a popular Python agent framework?
Yes, Pydantic AI is a popular and rapidly growing Python agent framework. Released in late 2024 by the team behind Pydantic—the immensely popular data validation library used across FastAPI and the Python machine learning ecosystem—it has quickly established itself as a top-tier framework in 2026.
Background: If you are using the popular Pydantic AI framework to build AI Agents, please audit your project dependencies immediately!
The NVD has published a critical security advisory, CVE-2026-107295 [CVE-2026-107295 Detail – NVD], identifying a vulnerability that impacts Pydantic AI’s local development web server endpoints (Agent.to_web() and the clai web command).
Exploit Mechanics Explained:
Because the local development server failed to enforce strict JSON Content-Type validation on the /api/chat endpoint, a malicious third-party website open in a developer’s browser could exploit this via Cross-Site Request Forgery (CSRF). By utilizing standard HTML forms or text/plain payloads, the malicious site can quietly target http://127[.]0[.]0[.]1:7932. If your local agent has capabilities enabled (like NativeTool(WebSearchTool())), the attacker can force the agent to execute terminal commands, run python tools under your local privileges, or leak sensitive API keys (like OPENAI_API_KEY) from your environment variables!
I have created an architecture and exploit chain infographic (attached) to help visualize exactly how the code definition, framework layers, and client-side CSRF vectors connect.
Vulnerability details: CVE-2026-107295 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1[.]34[.]0 until 1[.]107[.]4 and 2[.]28[.]0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1[.]107[.]4 and 2[.]28[.]0.
Official announcement: Please refer to the link for details –
https://www.tenable.com/cve/CVE-2026-107295
https://nvd.nist.gov/vuln/detail/cve-2026-107295
Buzz Lightyear’s famous catchphrase and space ranger slogan is “To infinity and beyond!”