CVE-2026-107293 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified within Pydantic AI, a Python agent framework designed for constructing applications and workflows with Generative AI models, represents a significant information disclosure risk stemming from improper configuration of OpenTelemetry instrumentation. This specific flaw exists in versions ranging from 0.3.4 up to 1.107.4 and version 2.27.1. The core issue arises when the framework is configured with InstrumentationSettings that explicitly set include_content to False, a setting typically intended to prevent sensitive data such as prompt contents or model outputs from being exported to telemetry backends for privacy reasons. Despite this configuration intent, the instrumentation logic fails to adequately filter out retry prompts associated with tool calls outside of direct tool invocation contexts. These retries are erroneously captured and exported within the gen_ai.input.messages attribute and the pydantic_ai.all_messages collection in the telemetry data stream.
From a technical perspective, the flaw lies in how the framework handles validation feedback during agent execution cycles. When an agent utilizes NativeOutput, PromptedOutput, or applies output validators to text-based outputs, it may encounter invalid model values that require correction through retry mechanisms. In these scenarios, the system generates validation feedback which includes quotes of the specific invalid values produced by the underlying large language model. Due to the aforementioned instrumentation bug, this sensitive context—including the quoted invalid values and the reasoning behind their rejection—is inadvertently included in the telemetry payload sent to external monitoring systems. This occurs specifically for tool-call retries that are not part of a direct tool call sequence, creating an unintended side channel through which internal state and potentially proprietary or private data can leak out of the application environment.
The operational impact of this vulnerability is substantial, particularly for organizations deploying Pydantic AI in production environments where telemetry backends such as Jaeger, Zipkin, or commercial APM solutions are used to monitor performance and trace execution flows. Attackers with access to these telemetry systems could potentially extract sensitive information that was intended to remain internal. This includes proprietary prompt engineering structures, specific data patterns processed by the agent, and details about how the application validates inputs. Such exposure violates fundamental security principles regarding data minimization and confidentiality, as it allows third parties or malicious insiders observing the backend infrastructure to reconstruct aspects of the AI workflow logic and potentially infer sensitive business rules or user data that was part of the failed validation attempts.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes stack traces from code in a web application, as well as CWE-532, exposure of information through log files. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1608, specifically the aspect of Link Accounts or Data Staging where data is collected for exfiltration via legitimate administrative channels like telemetry systems. The vulnerability highlights a critical gap in secure coding practices related to observability configurations, demonstrating that even when privacy-preserving settings are explicitly enabled, implementation errors can bypass these safeguards by leaking contextual metadata and validation artifacts rather than just raw content.
To mitigate this risk, organizations must immediately upgrade Pydantic AI to version 1.107.4 or later for the stable branch, or version 2.27.1 and above if using the development track. These versions contain patches that correct the instrumentation logic to ensure that retry prompts and validation feedback are properly excluded from telemetry exports when include_content is set to False. For deployments where upgrading is not immediately feasible, administrators should consider restricting access to OpenTelemetry backends to only authorized personnel with a strict need-to-know basis. Additionally, implementing network-level segmentation for monitoring infrastructure can limit the exposure surface if an attacker gains initial foothold in the telemetry pipeline. Regular audits of instrumentation configurations and validation of exported data against privacy policies are recommended to ensure that future updates or custom integrations do not reintroduce similar leakage vectors.