Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Summary
The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
Details
Once a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Origin check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.
Binding the web UI to localhost — the default — does not prevent this.
Impact
Applications and developers serving an agent through Agent.to_web() or clai web. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.
Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.
Mitigation
Upgrade to pydantic-ai/pydantic-ai-slim >= 2.30.0, or >= 1.107.5 on the v1 maintenance line.
The fix validates the Host header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding 421 Misdirected Request otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:
app = agent.to_web(allowed_hosts=['ui.example.com'])Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pydantic-ai | >= 1.34.0, < 1.107.5, >= 2.0.0b1, < 2.30.0 | 1.107.5, 2.30.0 |
| Python (PyPI) | pydantic-ai-slim | >= 1.34.0, < 1.107.5, >= 2.0.0b1, < 2.30.0 | 1.107.5, 2.30.0 |
References
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9
- https://github.com/pydantic/pydantic-ai/pull/7437
- https://github.com/pydantic/pydantic-ai/pull/7438
- https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe
- https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7
- https://github.com/pydantic/pydantic-ai
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0
- https://pypi.org/project/pydantic-ai
- https://github.com/advisories/GHSA-q2xc-rrxj-58x9
- https://nvd.nist.gov/vuln/detail/CVE-2026-107292
- https://pypi.org/project/pydantic-ai-slim
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L- Weakness (CWE)
CWE-346, CWE-350- Platform
- Python (PyPI)
- Package
pydantic-ai, pydantic-ai-slim- Disclosed
- 08.10.2026
- Updated
- 15.10.2026 18:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-4279 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-q2xc-rrxj-58x9 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-4288 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: pydantic-ai
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 02.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 8
- Low 2
Disclosures per year
- 2026: 14
-
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.