CVE-2026-107288

A low impact flaw was found in pydantic-ai, a Python agent framework shipped in Red Hat Enterprise Linux AI and Lightspeed Core. The local web_fetch_tool and the WebFetch local fallback compare configured blocked_domains entries against a URL hostname before both values are normalized to the form used for DNS resolution. A remote attacker able to influence model output can supply an equivalent IDNA spelling, a non-ASCII label separator, a case variation, or a trailing root label that resolves to a blocked host but does not match the configured blocklist string, causing the application to fetch that host with its own privileges and resulting in information disclosure from restricted hosts. Applications that rely on allowed_domains are not subject to this bypass, because allowlist matching fails closed for unmatched spellings, and the tools' private-IP and cloud-metadata protections remain effective. Red Hat and upstream both rate this flaw Low severity (CVSS 3.7). Because the impact is Low, the fix for the affected Red Hat Enterprise Linux AI and Lightspeed Core releases is deferred and no update trackers are filed for this issue; the residual risk is limited to information disclosure from hosts an application has explicitly listed in its blocked_domains configuration, and exploitation additionally requires the attacker to influence model output into fetching a specifically crafted domain spelling.