Pydantic AI 2.66 Security Upgrade: Patch 10 Advisories

On 4 November 2026, Pydantic AI shipped v2.66.0 with a security batch: ten advisories across pydantic-ai, pydantic-ai-slim, and pydantic-ai-harness. Two are High (CVSS 7.5). One hits local web fetch JSON expansion; the other hits harness private-key redaction ReDoS. The rest are Medium or Low issues around cloud metadata, OpenTelemetry credential logging, AG-UI and Vercel adapters, tool-schema expansion, file reconstitution from history, DNS-before-allowlist checks, and an earlier MCP URL-path leak that was fixed in 2.60.0 but disclosed with this release.

If you run agents that fetch URLs, redact secrets, expose AG-UI or Vercel AI adapters, or instrument embeddings with OpenTelemetry, treat this as an upgrade checklist, not a research paper. Patched floors are 2.66.0 (and 1.107.10 on the 1.x line) for the main packages, and 0.66.0 for the harness. CVE ID fields on the High advisories were empty when I checked the GitHub release notes, so this post uses the GHSA identifiers from that release.

Who is affected

Work through this list against your lockfile and how you construct agents:

• Local `web_fetch_tool` / `WebFetch` fallback on pydantic-ai or pydantic-ai-slim in ranges >=1.77.0,<=1.107.9 or >=2.0.0b1,<=2.65.0. Provider-native web fetch is not in scope for the High JSON-expansion advisory.
• `pydantic-ai-harness` `>=0.16.0,<=0.65.0` when you call redact_secrets or secret_data() with the default private_key pattern (it is on by default).
• Tencent Cloud hosts that allow local downloads (force_download='allow-local' or web_fetch_tool(allow_local_urls=True)), because 169.254.0.23 was missing from the metadata blocklist.
• OpenTelemetry embedding instrumentation that passes secrets through extra_headers or extra_body (those fields were recorded on spans).
• AG-UI or Vercel AI adapters that accept client-submitted tool schemas or large multi-part conversations.
• Decision models (DecisionModel subclasses / TypeSafeModel) from v2.46.0 onward when attackers can supply tool schemas (often via AG-UI).
• Serialized message history that reloads tool results shaped like Pydantic AI file types (including durable runners such as Temporal, DBOS, or Prefect).
• Domain allowlists on local web-fetch or Playwright egress policies that previously resolved DNS before rejecting a host.
• MCP capabilities that derived an id from a URL path containing a credential, on versions from 2.57.0 up to (but not including) 2.60.0. That one was already fixed in 2.60.0; rotate if you were on that window.

Sibling upgrade notes on this site cover other agent-stack security weeks: the Langflow 1.13.0 CVE upgrade, the FastMCP Prefab UI CVSS 10 issue, and the LiteLLM 1.107.0 compromise response. For a broader agent-framework orientation, see the Microsoft Agent Framework guide.

The ten advisories in Pydantic AI 2.66

How to upgrade Pydantic AI to 2.66

Confirm what you actually ship. Many projects pin pydantic-ai; some pin pydantic-ai-slim; harness is a separate distribution.

pip show pydantic-ai pydantic-ai-slim pydantic-ai-harness

2.x line (recommended if you are already on 2.x):

pip install -U 'pydantic-ai==2.66.0'
# or, if you use the slim distribution:
pip install -U 'pydantic-ai-slim==2.66.0'

1.x line (stay on 1.x until you are ready to move):

pip install -U 'pydantic-ai==1.107.10'
# or:
pip install -U 'pydantic-ai-slim==1.107.10'

Harness (independent of the main package major):

pip install -U 'pydantic-ai-harness==0.66.0'

Pin the exact floor in requirements.txt or your lockfile, then restart every worker, durable runner, and chat adapter process so they load the new wheels. If Poetry, uv, or pdm manages the project, bump the constraint and regenerate the lock in the same change.

Post-upgrade: rotate and tighten

Patching the library is necessary but not always sufficient:

1. OpenTelemetry embedding leaks (GHSA-jp94-mmr3-2pvv): anyone with access to historical traces may have seen extra_headers / extra_body. Restrict access to those backends and rotate the credentials that travelled in those fields.
2. MCP URL-path credentials (GHSA-mgmv-r532-pg36): if you ran 2.57.0 through 2.59.x with a secret in the MCP server URL path and exposed AG-UI or Vercel AI frontends, rotate that credential even if you already jumped past 2.60.0.
3. Keep allowlists on. Local web fetch and Playwright egress policies should still name the domains you intend. The Low DNS advisory is fixed, but allowlists remain the right default when models process untrusted content.
4. Tencent + allow-local. If you intentionally allow local downloads on Tencent Cloud, upgrade first; do not treat "allow local" as a permanent production setting without a clear need.

Version assert you can run in CI

Drop this script next to your agent service (or adapt it into a unit test). It skips missing packages, accepts either the 2.66.0 or 1.107.10 floor for the main distributions, and fails CI if an installed package is below the security floor.

#!/usr/bin/env python3
"""Assert installed Pydantic AI packages meet the 4 Nov 2026 security floor."""
from __future__ import annotations

import importlib.metadata as md
import sys

FLOORS = [
    ("pydantic-ai", "2.66.0"),
    ("pydantic-ai-slim", "2.66.0"),
    ("pydantic-ai-harness", "0.66.0"),
]
ONE_X_FLOOR = (1, 107, 10)
TWO_X_FLOOR = (2, 66, 0)


def parse(v: str) -> tuple[int, ...]:
    core = v.split("+", 1)[0].split(".dev", 1)[0]
    for sep in ("rc", "a", "b"):
        core = core.split(sep, 1)[0]
    parts: list[int] = []
    for p in core.split("."):
        if not p.isdigit():
            break
        parts.append(int(p))
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts[:3])


def main_ok(version: str) -> bool:
    t = parse(version)
    if t[0] >= 2:
        return t >= TWO_X_FLOOR
    if t[0] == 1:
        return t >= ONE_X_FLOOR
    return False


def check(name: str, floor: str) -> tuple[str, str]:
    try:
        ver = md.version(name)
    except md.PackageNotFoundError:
        return ("skip", f"{name}: not installed")
    if name in ("pydantic-ai", "pydantic-ai-slim"):
        ok = main_ok(ver)
        need = ">=2.66.0 or >=1.107.10"
    else:
        ok = parse(ver) >= parse(floor)
        need = f">={floor}"
    return (("ok", f"{name} {ver} OK ({need})") if ok
            else ("fail", f"{name} {ver} TOO OLD (need {need})"))


def main() -> int:
    results = [check(n, f) for n, f in FLOORS]
    for status, msg in results:
        print({"ok": "[ok]  ", "fail": "[FAIL]", "skip": "[skip]"}[status], msg)
    if any(s == "fail" for s, _ in results):
        return 1
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Run it with python check_pydantic_ai_versions.py after install. Exit code 1 means at least one installed package is still below the floor.

Practical takeaways

Pydantic AI is a typed agent framework on top of Pydantic models, tools, and provider APIs. The 2.66.0 security batch is mostly about untrusted input meeting synchronous work on the event loop (JSON pretty-print, schema inlining, message loading, regex redaction) plus a few credential-hygiene fixes. You do not need every advisory to apply to you; you do need a clear answer for web fetch, harness redaction, UI adapters, and whether secrets ever rode in OTel or MCP URLs.

Upgrade to 2.66.0 (or 1.107.10), bump harness to 0.66.0 if you use it, rotate anything that may have leaked, and keep fetch allowlists tight. That is the whole job for this release.