Industry story
Update: Pydantic AI v2.30.0 patches DNS rebinding security flaw in local agent UI
agent-framework guardrails security
Pydantic AI's local agent UI had a real exposure: skip the Host header check, and a malicious website could DNS-rebind its way into your local agent server and run it with your tools and credentials. Version 2.30.0 closes that gap by enforcing Host header validation against localhost and loopback addresses by default. If you're running Agent.to_web() or clai web in any environment, update now. Anyone deploying under a real hostname needs to explicitly set allowed_hosts, or the new validation will block them.
Full analysis
What's new since we last covered this: DNS rebinding vulnerability in local agent UI (distinct from prior CSRF flaw).
Pydantic AI v2.30.0 (released 2026-08-13) fixes a security vulnerability (GHSA-q2xc-rrxj-58x9) in the framework's local development web chat interface. The Agent.to_web() and clai web commands failed to validate the HTTP Host header, meaning a malicious website visited in a browser could use DNS rebinding to reach the local agent server and execute it with the user's local tools and credentials. The fix enforces Host header validation against localhost/loopback/LAN addresses by default; developers deploying under a real hostname must now explicitly opt in via a new allowed_hosts setting.
Comments