CVE-2026-107292: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer’s machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
References
- github.com/advisories/GHSA-q2xc-rrxj-58x9
- github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe
- github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7
- github.com/pydantic/pydantic-ai/pull/7437
- github.com/pydantic/pydantic-ai/pull/7438
- github.com/pydantic/pydantic-ai/releases/tag/v1.107.5
- github.com/pydantic/pydantic-ai/releases/tag/v2.30.0
- github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9
- nvd.nist.gov/vuln/detail/CVE-2026-107292
Code Behaviors & Features
Detect and mitigate CVE-2026-107292 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →