CVE-2026-107291: Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Vulnerability summary
CVE-2026-107291 is a medium (CVSS 4.3) vulnerability in pydantic pydantic_ai. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 08-10-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPydantic Ai
Maturity: poc
Weaknesses
CWE · root cause- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Pydantic3 products
- pydantic_ai≥ 0.3.4, < 1.107.4 | ≥ 2.0.0, < 2.44.0
- pydantic-ai≥ 0.3.4, < 1.107.6 | ≥ 2.0.0b1, < 2.44.0
- pydantic-ai-slim≥ 0.3.4, < 1.107.6 | ≥ 2.0.0b1, < 2.44.0
PyPI2 products
- pydantic-ai≥ 0.3.4, < 1.107.6 | ≥ 2.0.0b1, < 2.44.0
- pydantic-ai-slim≥ 0.3.4, < 1.107.6 | ≥ 2.0.0b1, < 2.44.0
2 vendors · 5 products
References
18 links- github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7fX Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/pydantic/pydantic-ai/commit/4e013c51a50659aba2adf7853bfb22bb77f6a518X Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/commit/6b14c74cb281f899a2ae4fae5327111e33f60771X Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/commit/7ee27e38ab2e525ca60ff1a25d16413ff989fd79X Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/commit/963dec5f70d6f558997fc259356c0090cc5ea487X Refsource MISCWEBPatch
Show all 18 references
- github.com/pydantic/pydantic-ai/commit/de4e61515327bd80a19cd8552001c30933e6acc3X Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/releases/tag/v1.107.6X Refsource MISCWEBPatchRelease NotesVendor Advisory
- github.com/pydantic/pydantic-ai/releases/tag/v2.44.0X Refsource MISCWEBPatchRelease NotesVendor Advisory
- pypi.org/project/pydantic-aiPACKAGE
