Read the docs
TI-2026-69602 Aliases CVE-2026-107291GHSA-4x9p-g9wm-8q7f

Pydantic AI telemetry leaks content when include_content=False

Priority LOW 13CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

pydantic-ai and pydantic-ai-slim from 0.3.4 before 1.107.6 and from 2.0.0b1 before 2.44.0 are affected. With include_content=False, OpenTelemetry instrumentation still exports agent content through exception events and error status descriptions (CWE-532). Readers of the telemetry backend can see tool feedback, provider error bodies and runtime instructions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00622 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pydantic-ai (pydantic): 1.107.6, 2.44.0pydantic-ai-slim (pydantic): 1.107.6, 2.44.0+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai0.3.4 to before 1.107.6; 2.0.0b1 to before 2.44.01.107.6, 2.44.0Patch availableCNA
pydanticpydantic-ai-slim0.3.4 to before 1.107.6; 2.0.0b1 to before 2.44.01.107.6, 2.44.0Patch availableCNA
—pydantic-ai (PyPI)0.3.4 to before 1.107.61.107.6Patch availableGHSA-4x9p-g9wm-8q7f
—pydantic-ai (PyPI)2.0.0b1 to before 2.44.02.44.0Patch availableGHSA-4x9p-g9wm-8q7f
—pydantic-ai-slim (PyPI)0.3.4 to before 1.107.61.107.6Patch availableGHSA-4x9p-g9wm-8q7f
—pydantic-ai-slim (PyPI)2.0.0b1 to before 2.44.02.44.0Patch availableGHSA-4x9p-g9wm-8q7f
  • pydantic-ai Vendorpydantic Affected 0.3.4 to before 1.107.6; 2.0.0b1 to before 2.44.0 Fixed in 1.107.6, 2.44.0 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 0.3.4 to before 1.107.6; 2.0.0b1 to before 2.44.0 Fixed in 1.107.6, 2.44.0 Patch available CNA
  • pydantic-ai (PyPI) Vendor— Affected 0.3.4 to before 1.107.6 Fixed in 1.107.6 Patch available GHSA-4x9p-g9wm-8q7f
  • pydantic-ai (PyPI) Vendor— Affected 2.0.0b1 to before 2.44.0 Fixed in 2.44.0 Patch available GHSA-4x9p-g9wm-8q7f
  • pydantic-ai-slim (PyPI) Vendor— Affected 0.3.4 to before 1.107.6 Fixed in 1.107.6 Patch available GHSA-4x9p-g9wm-8q7f
  • pydantic-ai-slim (PyPI) Vendor— Affected 2.0.0b1 to before 2.44.0 Fixed in 2.44.0 Patch available GHSA-4x9p-g9wm-8q7f

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*0.3.4 to before 1.107.4Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*2.0.0 to before 2.44.0Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 0.3.4 to before 1.107.4 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:* Versions 2.0.0 to before 2.44.0 Vulnerable ·pydantic

Remediation

Upgrade pydantic-ai and pydantic-ai-slim to version 1.107.6 or 2.44.0 on PyPI. Red Hat lists Lightspeed Core and Red Hat Enterprise Linux AI (RHEL AI) 3 as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.107.6, 2.44.0
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 1.107.6, 2.44.0
  • Fix · GHSA-4x9p-g9wm-8q7f pydantic-ai (PyPI) Fixed in 1.107.6 Advisory →
  • Fix · GHSA-4x9p-g9wm-8q7f pydantic-ai (PyPI) Fixed in 2.44.0 Advisory →
  • Fix · GHSA-4x9p-g9wm-8q7f pydantic-ai-slim (PyPI) Fixed in 1.107.6 Advisory →
  • Fix · GHSA-4x9p-g9wm-8q7f pydantic-ai-slim (PyPI) Fixed in 2.44.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107291
  2. 2026-10-08 Alias added: GHSA-4x9p-g9wm-8q7f
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-09 CVSS score added · Red Hat
  5. 2026-10-13 CVSS score added · NVD
  6. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 11

Advisory 1

Other 1

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences