CVE-2026-65975

Analyzed Analyzed - Analysis Complete

Authentication Bypass via Tool Call Sanitization in Pydantic AI

Publication date: 2026-07-29

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-65975

Affected Vendors & Products

Vendor	Product	Version / Range
pydantic	pydantic_ai	From 1.88.0 (inc) to 1.107.1 (exc)
pydantic	pydantic_ai	From 2.0.0 (inc) to 2.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Pydantic AI versions 1.88.0 to 1.107.0 and 2.0.0b1 to 2.4.9 have a flaw where UI adapters strip unresolved client tool calls from message history but use an outdated message index. If a trailing client message is removed during sanitization, an assistant response with an unresolved tool call may become the new tail and bypass inspection. This allows a remote client to execute registered server tools with client-supplied arguments instead of model-generated ones.

Detection Guidance

Detection involves checking if your Pydantic AI version is vulnerable (1.88.0 to <1.107.1 or 2.0.0b1 to <2.5.0). Run: pip show pydantic-ai to check the installed version. If affected, inspect agent configurations using AG-UI or VercelAIAdapter for unresolved tool calls in message history.

Impact Analysis

The impact depends on the tools affected. Applications using gated tool execution (before_model_request/after_model_request hooks) are most at risk since forged calls skip model turns and bypass guardrails. Approval-gated tools (requires_approval=True) are not auto-executed via this path. The vulnerability could lead to unintended actions if tools accept client arguments.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized execution of server tools with client-supplied arguments. If an application uses gated tool execution in hooks, forged tool calls might bypass model-request validation, increasing the risk of data exposure or unauthorized actions. However, the impact depends on the specific tools and their configurations.

Mitigation Strategies

Upgrade Pydantic AI to version 1.107.1 or 2.5.0 or later. If immediate upgrade isn't possible, disable AG-UI and VercelAIAdapter features or implement manual sanitization of client-submitted tool calls before processing.

Hi! I’m here to help you understand CVE-2026-65975. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70