Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-107288
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:05 UTC · Revision 1
Source evidence
Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
core-osv · Original sourcePublished 8 Oct 2026, 15:18 UTC
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.
osv:CVE-2026-107288
Complete source record
{
"id": "3bf352fa6e573c04df8b5f4ea646d5c3a1b0008150ca3fd095c8a25a859e6e78",
"url": "https://osv.dev/vulnerability/CVE-2026-107288",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently",
"summary": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.",
"evidence": "osv:CVE-2026-107288",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-107288",
"aliases": [
"CVE-2026-107288",
"GHSA-22h6-qm39-v87j"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pydantic/pydantic-ai",
"type": "GIT",
"events": [
{
"introduced": "a282bcade2c2a75847806bbba9cf511dd0623019"
},
{
"fixed": "7ee27e38ab2e525ca60ff1a25d16413ff989fd79"
},
{
"introduced": "e19e18065a13be0490483ad3c5601d232af8185b"
},
{
"fixed": "9fdabb4b2afb54ff7deb9013f6b43971324d9181"
},
{
"fixed": "490335f8e2322e143a79337ddca9410e0176c812"
},
{
"fixed": "a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284"
},
{
"fixed": "c1f212a084cbfa0012f2044cdb4731d214b3b983"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*",
"range": [
{
"introduced": "1.77.0"
},
{
"fixed": "1.107.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.44.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "490335f8e2322e143a79337ddca9410e0176c812"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "c1f212a084cbfa0012f2044cdb4731d214b3b983"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "7ee27e38ab2e525ca60ff1a25d16413ff989fd79"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.107.6"
},
{
"range": [
{
"fixed": "9fdabb4b2afb54ff7deb9013f6b43971324d9181"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.44.0"
}
]
}
}
],
"versions": [
"v1.107.5",
"v2.43.0",
"v2.42.0",
"v2.41.0",
"v2.40.0",
"v2.39.0",
"v2.38.0",
"v2.37.0",
"v2.36.0",
"v2.35.3",
"v2.35.1",
"v2.35.0",
"v2.34.0",
"v2.33.0",
"v2.32.2",
"v2.32.1",
"v2.32.0",
"v2.31.1",
"v2.31.0",
"v2.30.0",
"v1.107.4",
"v2.29.0",
"v2.28.0",
"v1.107.2",
"v2.27.1",
"v2.27.0",
"v1.107.1",
"v2.26.0",
"v2.25.0",
"v2.24.0",
"v2.23.0",
"v2.22.0",
"v2.21.0",
"v2.20.0",
"v2.19.0",
"v2.18.0",
"v2.17.0",
"v2.16.0",
"v2.15.0",
"v2.14.1",
"v2.14.0",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.0",
"v2.9.1",
"v2.9.0",
"v1.107.0",
"v2.8.0",
"v2.7.0",
"v2.6.0",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v2.0.0",
"v1.106.0",
"v1.105.0",
"v1.104.0",
"v1.103.0",
"v1.102.0",
"v1.91.0",
"v1.101.0",
"v1.100.0",
"v1.99.0",
"v1.98.0",
"v1.97.0",
"v1.96.0",
"v1.96.1",
"v1.94.0",
"v1.95.1",
"v1.95.0",
"v1.93.0",
"v1.92.0",
"v1.90.0",
"v1.89.1",
"v1.89.0",
"v1.88.0",
"v1.87.0",
"v1.86.0",
"v1.86.1",
"v1.85.1",
"v1.85.0",
"v1.84.1",
"v1.84.0",
"v1.83.0",
"v1.82.0",
"v1.81.0",
"v1.80.0",
"v1.79.0",
"v1.78.0",
"v1.77.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107288.json"
}
}
],
"modified": "2026-10-28T02:30:32.820398516Z",
"provider": "osv",
"references": [
"https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6",
"https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107288.json",
"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j",
"https://nvd.nist.gov/vuln/detail/CVE-2026-107288",
"https://github.com/pydantic/pydantic-ai/commit/490335f8e2322e143a79337ddca9410e0176c812",
"https://github.com/pydantic/pydantic-ai/commit/a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284",
"https://github.com/pydantic/pydantic-ai/commit/c1f212a084cbfa0012f2044cdb4731d214b3b983",
"https://github.com/pydantic/pydantic-ai/pull/8407",
"https://github.com/pydantic/pydantic-ai/pull/8409",
"https://github.com/pydantic/pydantic-ai/pull/8421"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1289",
"CWE-918"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107288.json"
}
},
"related_cves": [
{
"value": "CVE-2026-107288",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499870,
"published_at": "2026-10-08T15:18:40.047+00:00"
}