CVE-2026-65975
Description
A flaw was found in Pydantic AI's UI adapters, specifically within the sanitize_messages function. This vulnerability allows a remote client to bypass security checks and execute server tools with arguments they provide, rather than those generated by the AI model. This occurs when a trailing client message is removed, causing a previous, unverified tool call to be processed. The impact depends on the functionality of the affected tools, potentially bypassing critical security guardrails.
Statement
This flaw in Pydantic AI allows remote clients to execute server tools with arbitrary arguments by bypassing message sanitization, potentially leading to unintended actions depending on the functionality of the exposed tools. This affects Red Hat Lightspeed Core when utilizing the vulnerable Pydantic AI framework.
Mitigation
Configure Pydantic AI tools to require explicit approval for execution. This prevents remote clients from automatically executing server tools with forged arguments, as approval-gated tools are not affected by this vulnerability. Additionally, restrict network access to the Pydantic AI application to trusted clients only, if feasible in your environment.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
