Pydantic AI Framework Vulnerability in OpenTelemetry Instrumentation
CVE-2026-107293
2.3LOW
What is CVE-2026-107293?
A vulnerability exists in the Pydantic AI framework, specifically affecting versions from 0.3.4 through 1.107.4 and 2.27.1, where OpenTelemetry instrumentation can unintentionally expose retry prompts. This occurs when the InstrumentationSettings are configured with 'include_content=False', leading to potential data leakage of validation feedback, including sensitive model values. This issue impacts agents utilizing NativeOutput, PromptedOutput, or output validators. Versions 1.107.4 and 2.27.1 address this vulnerability.
Affected Version(s)
pydantic-ai >= 0.3.4, < 1.107.4 < 0.3.4, 1.107.4
pydantic-ai >= 2.0.0b1, < 2.27.1 < 2.0.0b1, 2.27.1
pydantic-ai-slim >= 0.3.4, < 1.107.4 < 0.3.4, 1.107.4