CVE-2026-107293: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Vulnerability summary
CVE-2026-107293 is a medium (CVSS 5.3) vulnerability in pydantic pydantic_ai. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22.4% of scored vulnerabilities.
Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 08-10-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Pydantic3 products
- pydantic_ai≥ 0.3.4, < 1.107.4 | ≥ 2.0.0, < 2.27.1
- pydantic-ai≥ 0.3.4, < 1.107.4 | ≥ 2.0.0b1, < 2.27.1
- pydantic-ai-slim≥ 0.3.4, < 1.107.4 | ≥ 2.0.0b1, < 2.27.1
PyPI2 products
- pydantic-ai≥ 0.3.4, < 1.107.4 | ≥ 2.0.0b1, < 2.27.1
- pydantic-ai-slim≥ 0.3.4, < 1.107.4 | ≥ 2.0.0b1, < 2.27.1
2 vendors · 5 products
References
9 links- github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4X Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594fX Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/releases/tag/v2.27.1X Refsource MISCWEBPatchRelease NotesVendor Advisory
- pypi.org/project/pydantic-aiPACKAGE
