CVE-2026-107293
Description
A flaw was found in pydantic-ai. An information disclosure vulnerability occurs when OpenTelemetry instrumentation is configured to omit message contents, as retry prompts generated during output validation are still exported to the telemetry backend. A user with read access to telemetry logs can view validation feedback and model outputs that were intended to be suppressed.
Statement
A moderate information disclosure vulnerability was found in the pydantic-ai Python agent framework, as shipped in Red Hat Enterprise Linux AI and Lightspeed Core. When pydantic-ai's OpenTelemetry instrumentation is configured with InstrumentationSettings(include_content=False) to suppress message content, retry prompts generated during output validation of agents that do not use tool calls — for example structured output via NativeOutput or PromptedOutput, or output validators applied to text output — are still exported to the telemetry backend in span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. A user with read access to the telemetry logs or backend can therefore view validation feedback and invalid model values that were intended to be withheld. Deployments that do not use include_content=False, and retries tied to tool calls, are not affected by this path. Red Hat Enterprise Linux AI and Lightspeed Core are listed as affected; because the issue is rated moderate impact with a CVSS score below 7.0, fixes for the affected products are deferred, leaving the residual risk that message content meant to be suppressed continues to be exposed to readers of the telemetry backend until a fix is delivered. The upstream advisory rates this flaw as low severity (CVSS 2.3), which is lower than Red Hat's moderate rating (CVSS 4.3).
Mitigation
Until the deferred fix is delivered, the exposure can be reduced by scrubbing or dropping the message attributes gen_ai.input.messages, gen_ai.output.messages, and pydantic_ai.all_messages in the telemetry pipeline, for example with an OpenTelemetry Collector processor, or by switching agents to tool-based structured output modes, whose retry feedback is correctly redacted when include_content=False. Previously exported traces can also be reviewed for retry prompt content that should not have been recorded. Upgrading pydantic-ai to a version containing the upstream fix (1.107.4 for the 1.x series or 2.27.1 for the 2.x series) resolves the issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | 5.3 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | Low | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
