CVE-2026-107293 · GHSA-3gh4-cghq-f8v4
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
- Risk score
- 41/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_…
- Affected
- pydantic-ai (pip) >= 0.3.4, < 1.107.4; pydantic-ai (pip) >= 2.0.0b1, < 2.27.1; pydantic-ai-slim (pip) >= 0.3.4, < 1.107.4; pydantic-ai-slim (pip) >= 2.0.0b1, < 2.27.1
- Fix
- Upgrade pydantic-ai to 1.107.4 or 2.27.1; pydantic-ai-slim to 1.107.4 or 2.27.1 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
pydantic-ai: Amber, patch this week. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowin…
The flaws
- CVE-2026-107293: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` (CVSS 5.3 · EPSS 0%)
- CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (CVSS 7.5 · EPSS 0%)
- CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (CVSS 7.6 · EPSS 0%)
- CVE-2026-107290: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (CVSS 6.5 · EPSS 0%)
The fix
Upgrade pydantic-ai: 1.107.4 · 2.27.1 · 2.53.0 · 2.28.0 · 1.107.6 · 2.44.0 or later on your release line
Who is exposed: pydantic-ai (pip) >= 2.10.0, < 2.53.0; pydantic-ai-slim (pip) >= 2.10.0, < 2.53.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-212 (CWE-212). 4 other warnings in 30 days
- Same product: Earlier pydantic-ai warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pydantic-ai | pip | >= 0.3.4, < 1.107.4 | 1.107.4 |
| pydantic-ai | pip | >= 2.0.0b1, < 2.27.1 | 2.27.1 |
| pydantic-ai-slim | pip | >= 0.3.4, < 1.107.4 | 1.107.4 |
| pydantic-ai-slim | pip | >= 2.0.0b1, < 2.27.1 | 2.27.1 |
References
- https://github.com/advisories/GHSA-3gh4-cghq-f8v4
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4
- https://github.com/pydantic/pydantic-ai/pull/7357
- https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1
- https://github.com/advisories/GHSA-3gh4-cghq-f8v4
Original description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
Last activity 8 Oct 2026. Patch Forecast updates every hour.