Pydantic AI Web Chat UI: Any Website the Developer Visits Can Run the Agent and Its Approval-Gated Tools (CVE-2026-107295)

`pydantic-ai` and `pydantic-ai-slim` `Agent.to_web()` and `clai web`, versions 1.34.0 to before 1.107.4 and 2.0.0b1 to before 2.28.0

The local chat endpoint did not enforce a JSON Content-Type, so a cross-origin page could POST to it and start agent runs that executed server-side tools with the developer's local credentials, despite the default localhost binding. Tools marked `requires_approval=True` were also reachable because the endpoint trusted approval decisions relayed by the client. Fixed in 1.107.4 and 2.28.0. Seven related advisories published the same day include missing Host header validation (CVE-2026-107292) and an SSRF blocklist bypass through IPv6 zone IDs (CVE-2026-107289). Credited to Thai Son Dinh (VinSOC Labs). Single source (GitHub advisory)

A CSRF-reachable local agent endpoint, and human approval enforced by whatever the client claims rather than on the server