CVE-2026-107291

A moderate information disclosure flaw was found in the Pydantic AI agent framework, which is shipped in Red Hat Enterprise Linux AI and Lightspeed Core products. When Pydantic AI's OpenTelemetry instrumentation is configured with InstrumentationSettings(include_content=False) to exclude sensitive message content from exported telemetry, several other parts of the same spans are not redacted: exception events record full exception messages and stack traces (including tool retry feedback that can quote tool arguments and results, and provider error response bodies), span error status descriptions repeat the exception message, and the model_request_parameters attribute serializes the agent's runtime instructions and the prompted structured-output template. Anyone with read access to the configured telemetry backend, such as a third-party observability vendor or a shared backend whose audience is broader than the agent's own data, can read this confidential agent content. The flaw does not grant any new access to the agent or its data beyond visibility of the exported traces, and deployments that do not enable include_content=False are not affected; instructions are exported on every successful run, while the exception paths additionally require a tool to raise or a model, embedding, or image generation request to fail. Red Hat rates this flaw as moderate severity (CVSS 3.1 score 4.3), whereas the upstream advisory rates it low severity (CVSS 4.0 score 2.3); this difference reflects Red Hat's assessment of the confidentiality impact on products that ship the affected package. For the affected Red Hat Enterprise Linux AI and Lightspeed Core components, the fix is currently deferred because the impact is moderate and the CVSS score is below 7.0, which does not meet the bar for prioritizing an update for this issue. The residual risk of deferring is that sensitive agent content continues to be exported to, and readable by readers of, telemetry backends populated by affected deployments that use include_content=False.