{"id":"CVE-2026-107292","aliases":["EUVD-2026-95099","GHSA-q2xc-rrxj-58x9","PYSEC-2026-4279","PYSEC-2026-4288"],"status":"published","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00132,"percentile":0.02845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346","CWE-350"],"published":"2026-10-08T16:26:48Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"PyPI","package":"pydantic-ai","fixed_in":["1.107.5","2.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"pydantic-ai-slim","fixed_in":["1.107.5","2.30.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pydantic-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pydantic-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pydantic-ai-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pydantic-ai-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"}]}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.107.2","1.107.4","1.34.0","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.40.0","1.41.0","1.42.0","1.43.0","1.44.0","1.46.0","1.47.0","1.48.0","1.49.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.60.0","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.67.0","1.68.0","1.69.0","1.70.0","1.71.0","1.72.0","1.73.0","1.74.0","1.75.0","1.76.0","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0"]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.27.1","2.28.0","2.29.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"}]}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.107.2","1.107.4","1.34.0","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.40.0","1.41.0","1.42.0","1.43.0","1.44.0","1.46.0","1.47.0","1.48.0","1.49.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.60.0","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.67.0","1.68.0","1.69.0","1.70.0","1.71.0","1.72.0","1.73.0","1.74.0","1.75.0","1.76.0","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0"]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.27.1","2.28.0","2.29.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"},{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.107.2","1.107.4","1.34.0","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.40.0","1.41.0","1.42.0","1.43.0","1.44.0","1.46.0","1.47.0","1.48.0","1.49.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.60.0","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.67.0","1.68.0","1.69.0","1.70.0","1.71.0","1.72.0","1.73.0","1.74.0","1.75.0","1.76.0","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0","2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.27.1","2.28.0","2.29.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pydantic-ai-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.0"},{"fixed":"1.107.5"},{"introduced":"2.0.0b1"},{"fixed":"2.30.0"}]}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.107.2","1.107.4","1.34.0","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.40.0","1.41.0","1.42.0","1.43.0","1.44.0","1.46.0","1.47.0","1.48.0","1.49.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.60.0","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.67.0","1.68.0","1.69.0","1.70.0","1.71.0","1.72.0","1.73.0","1.74.0","1.75.0","1.76.0","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0","2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.27.1","2.28.0","2.29.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]}],"products":[{"vendor":"pydantic","product":"pydantic-ai"},{"vendor":"pydantic","product":"pydantic-ai-slim"},{"vendor":"pydantic","product":"pydantic_ai"}],"references":[{"url":"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/pydantic/pydantic-ai/pull/7437","tags":["x_refsource_MISC","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/pydantic/pydantic-ai/pull/7438","tags":["x_refsource_MISC","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5","tags":["x_refsource_MISC","Patch","Release Notes","Vendor Advisory","web"]},{"url":"https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0","tags":["x_refsource_MISC","Patch","Release Notes","Vendor Advisory","web"]},{"url":"https://github.com/advisories/GHSA-q2xc-rrxj-58x9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107292.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107292","tags":["advisory"]},{"url":"https://github.com/pydantic/pydantic-ai","tags":["package"]},{"url":"https://pypi.org/project/pydantic-ai","tags":["package"]},{"url":"https://pypi.org/project/pydantic-ai-slim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107292","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","status":"published","published":"2026-10-08T16:26:48.144Z","modified":"2026-10-14T01:01:07.59Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-346","CWE-350"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95099","description":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","status":"published","published":"2026-10-08T16:26:48Z","modified":"2026-10-14T01:01:07Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"ghsa":[{"id":"GHSA-q2xc-rrxj-58x9","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"### Summary\n\nThe Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) does not validate the `Host` header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.\n\n### Details\n\nOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an `Origin` check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.\n\nBinding the web UI to localhost — the default — does not prevent this.\n\n### Impact\n\nApplications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.\n\nCurrent browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.\n\n### Mitigation\n\nUpgrade to `pydantic-ai`/`pydantic-ai-slim` \u003e= 2.30.0, or \u003e= 1.107.5 on the v1 maintenance line.\n\nThe fix validates the `Host` header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding `421 Misdirected Request` otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:\n\n```python\napp = agent.to_web(allowed_hosts=['ui.example.com'])\n```","status":"published","published":"2026-10-08T17:16:39Z","modified":"2026-10-08T17:16:42Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-346","CWE-350"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107292","description":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","status":"published","published":"2026-10-08T17:17:14.77Z","modified":"2026-10-14T01:17:05.36Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-346","CWE-350"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107292","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","status":"published","published":"2026-10-08T16:26:48.144Z","modified":"2026-10-28T02:30:20.817966999Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-346","CWE-350"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-q2xc-rrxj-58x9","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"### Summary\n\nThe Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) does not validate the `Host` header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.\n\n### Details\n\nOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an `Origin` check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.\n\nBinding the web UI to localhost — the default — does not prevent this.\n\n### Impact\n\nApplications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.\n\nCurrent browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.\n\n### Mitigation\n\nUpgrade to `pydantic-ai`/`pydantic-ai-slim` \u003e= 2.30.0, or \u003e= 1.107.5 on the v1 maintenance line.\n\nThe fix validates the `Host` header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding `421 Misdirected Request` otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:\n\n```python\napp = agent.to_web(allowed_hosts=['ui.example.com'])\n```","status":"published","published":"2026-10-08T17:16:39Z","modified":"2026-10-15T14:55:53.965535964Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-346","CWE-350"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"PYSEC-2026-4279","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"### Summary\n\nThe Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) does not validate the `Host` header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.\n\n### Details\n\nOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an `Origin` check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.\n\nBinding the web UI to localhost — the default — does not prevent this.\n\n### Impact\n\nApplications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.\n\nCurrent browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.\n\n### Mitigation\n\nUpgrade to `pydantic-ai`/`pydantic-ai-slim` \u003e= 2.30.0, or \u003e= 1.107.5 on the v1 maintenance line.\n\nThe fix validates the `Host` header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding `421 Misdirected Request` otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:\n\n```python\napp = agent.to_web(allowed_hosts=['ui.example.com'])\n```","status":"published","published":"2026-10-15T10:22:51.6049Z","modified":"2026-10-15T14:55:53.965535964Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"PYSEC-2026-4288","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header","description":"### Summary\n\nThe Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) does not validate the `Host` header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.\n\n### Details\n\nOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an `Origin` check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.\n\nBinding the web UI to localhost — the default — does not prevent this.\n\n### Impact\n\nApplications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.\n\nCurrent browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.\n\n### Mitigation\n\nUpgrade to `pydantic-ai`/`pydantic-ai-slim` \u003e= 2.30.0, or \u003e= 1.107.5 on the v1 maintenance line.\n\nThe fix validates the `Host` header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding `421 Misdirected Request` otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:\n\n```python\napp = agent.to_web(allowed_hosts=['ui.example.com'])\n```","status":"published","published":"2026-10-15T10:22:51.687185Z","modified":"2026-10-15T14:55:53.965535964Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}