CVE-2026-107292: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

With DNS rebinding, a name the attacker controls first resolves to their server, then to the loopback address. The browser treats the later requests as same-origin to the attacker's page, so neither an Origin check nor a CSRF token constrains them, and the page can read the served UI and any token in it. Binding to localhost, the default, does not help.

The developer must visit the attacker's page while the UI runs, and timing makes it harder, which the vector reflects with high complexity and required interaction. The attacker can then drive the agent. Consequences depend on its tools and can include data disclosure and unwanted side effects with the local process's credentials.

The advisory notes browser defenses help only partly. Chromium's Local Network Access gates loopback subresource requests but not top-level navigations, and Safari does not implement it.

Affected: pydantic-ai and pydantic-ai-slim from 1.34.0 up to 1.107.5, and from 2.0.0b1 up to 2.30.0, when you serve an agent through Agent.to_web() or clai web.

pip show pydantic-ai pydantic-ai-slim

Search scripts and shell history for to_web( and clai web.

Upgrade to pydantic-ai or pydantic-ai-slim 2.30.0, or 1.107.5 on the v1 line. The fix checks the Host header and answers 421 Misdirected Request unless it is localhost, a loopback or LAN IP address, or an explicitly allowed host.

If you serve the UI under a real hostname, behind a reverse proxy or tunnel, name it:

app = agent.to_web(allowed_hosts=['ui.example.com'])

The advisory lists no workaround for unpatched versions.

In UI access logs, look for requests whose Host header is a name that is not localhost or a known host, since a rebinding attack arrives with the attacker's domain. After patching, such requests appear as 421 responses. Review agent run and tool-call history for runs you did not start.

Summary

The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.

Details

Once a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Origin check nor a CSRF token constrains it — a same-origin page can read the served UI and any token in it.

Binding the web UI to localhost — the default — does not prevent this.

Impact

Applications and developers serving an agent through Agent.to_web() or clai web. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects.

Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it.

Mitigation

Upgrade to pydantic-ai/pydantic-ai-slim >= 2.30.0, or >= 1.107.5 on the v1 maintenance line.

The fix validates the Host header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding 421 Misdirected Request otherwise. If you serve the web chat UI under a real hostname — behind a reverse proxy, tunnel, or similar — name it explicitly:

app = agent.to_web(allowed_hosts=['ui.example.com'])