CVE-2026-107293: low-severity vulnerability in pydantic-ai
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.3epss 0.3%
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Related CVEs — pydantic-ai
In the same product, most dangerous first.
CVE-2026-25580HIGHPydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download HandlingEPSS 0.6%CVE-2026-107291LOWPydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`EPSS 0.6%CVE-2026-107290MEDIUMPydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`EPSS 0.5%CVE-2026-107286HIGHPydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyEPSS 0.4%CVE-2026-107294MEDIUMPydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlEPSS 0.4%CVE-2026-48782MEDIUMpydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)EPSS 0.4%