---
id: CVE-2026-107288
title: >-
  Pydantic AI is a Python agent framework for building applications and
  workflows with Generative AI
summary: >-
  Pydantic AI is a Python agent framework for building applications and
  workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local
  web_fetch_tool and the WebFetch local fallback compare blocked_domains entries
  with a URL…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
  - CWE-1289
vendor: pydantic
product: pydantic_ai
affected:
  - 'pydantic_ai >= 1.77.0, < 1.107.6'
  - 'pydantic_ai >= 2.0.0, < 2.44.0'
patched:
  - pydantic_ai 2.44.0
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:35:05.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107288'
references:
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/490335f8e2322e143a79337ddca9410e0176c812
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/c1f212a084cbfa0012f2044cdb4731d214b3b983
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8407'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8409'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8421'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107288.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107288'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2548034'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-107288'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107288'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00368
epssPercentile: 0.30533
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T17:28:31.014859Z'
ingestedAt: '2026-10-08T16:52:14.772Z'
---

## Overview

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.

## Affected

- `pydantic_ai >= 1.77.0, < 1.107.6`
- `pydantic_ai >= 2.0.0, < 2.44.0`

## Remediation

Upgrade past the affected range:

- `pydantic_ai 2.44.0`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107288.json)