Read the docs
TI-2026-69601 Aliases CVE-2026-107293GHSA-3gh4-cghq-f8v4

Retry prompts leak into Pydantic AI OpenTelemetry telemetry

Priority LOW 12CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

The pydantic-ai and pydantic-ai-slim PyPI packages from 0.3.4 before 1.107.4 and from 2.0.0b1 before 2.27.1 are affected. With include_content=False, OpenTelemetry instrumentation still exports retry prompts outside tool calls without redaction (CWE-532). Agents using NativeOutput, PromptedOutput or output validators can expose validation feedback, including invalid model values, to readers of the telemetry backend.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Partial pydantic-ai (pydantic): 1.107.4, 2.27.1pydantic-ai-slim (pydantic): 1.107.4, 2.27.1+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai0.3.4 to before 1.107.4; 2.0.0b1 to before 2.27.11.107.4, 2.27.1Patch availableCNA
pydanticpydantic-ai-slim0.3.4 to before 1.107.4; 2.0.0b1 to before 2.27.11.107.4, 2.27.1Patch availableCNA
—pydantic-ai (PyPI)0.3.4 to before 1.107.41.107.4Patch availableGHSA-3gh4-cghq-f8v4
—pydantic-ai (PyPI)2.0.0b1 to before 2.27.12.27.1Patch availableGHSA-3gh4-cghq-f8v4
—pydantic-ai-slim (PyPI)0.3.4 to before 1.107.41.107.4Patch availableGHSA-3gh4-cghq-f8v4
—pydantic-ai-slim (PyPI)2.0.0b1 to before 2.27.12.27.1Patch availableGHSA-3gh4-cghq-f8v4
  • pydantic-ai Vendorpydantic Affected 0.3.4 to before 1.107.4; 2.0.0b1 to before 2.27.1 Fixed in 1.107.4, 2.27.1 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 0.3.4 to before 1.107.4; 2.0.0b1 to before 2.27.1 Fixed in 1.107.4, 2.27.1 Patch available CNA
  • pydantic-ai (PyPI) Vendor— Affected 0.3.4 to before 1.107.4 Fixed in 1.107.4 Patch available GHSA-3gh4-cghq-f8v4
  • pydantic-ai (PyPI) Vendor— Affected 2.0.0b1 to before 2.27.1 Fixed in 2.27.1 Patch available GHSA-3gh4-cghq-f8v4
  • pydantic-ai-slim (PyPI) Vendor— Affected 0.3.4 to before 1.107.4 Fixed in 1.107.4 Patch available GHSA-3gh4-cghq-f8v4
  • pydantic-ai-slim (PyPI) Vendor— Affected 2.0.0b1 to before 2.27.1 Fixed in 2.27.1 Patch available GHSA-3gh4-cghq-f8v4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*0.3.4 to before 1.107.4Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*2.0.0 to before 2.27.1Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 0.3.4 to before 1.107.4 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:* Versions 2.0.0 to before 2.27.1 Vulnerable ·pydantic

Remediation

Update pydantic-ai and pydantic-ai-slim to 1.107.4 on the 1.x line or to 2.27.1 on the 2.x line. Red Hat lists Lightspeed Core and Red Hat Enterprise Linux AI (RHEL AI) 3 as affected with no fix plan.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.107.4, 2.27.1
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 1.107.4, 2.27.1
  • Fix · GHSA-3gh4-cghq-f8v4 pydantic-ai (PyPI) Fixed in 1.107.4 Advisory →
  • Fix · GHSA-3gh4-cghq-f8v4 pydantic-ai (PyPI) Fixed in 2.27.1 Advisory →
  • Fix · GHSA-3gh4-cghq-f8v4 pydantic-ai-slim (PyPI) Fixed in 1.107.4 Advisory →
  • Fix · GHSA-3gh4-cghq-f8v4 pydantic-ai-slim (PyPI) Fixed in 2.27.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107293
  2. 2026-10-08 Alias added: GHSA-3gh4-cghq-f8v4
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-09 CVSS score added · Red Hat
  5. 2026-10-13 CVSS score added · NVD

References

Patch 3

Advisory 1

Other 1

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences