Pydantic AI CVE-2026-107291

Exploitation requires the non-default protective setting InstrumentationSettings(include_content=False) to be active (deployments not using this setting are explicitly unaffected by the bypass), OpenTelemetry instrumentation to be enabled, and an error condition - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request/embedding/image-generation call - to actually occur so that an exception event, stack trace, error status description, or serialized model_request_parameters (instructions / prompted_output_template) is produced. The exposure is further limited because it grants no new access to agent data: the leaked content only reaches parties who already have read access to the configured telemetry backend, so impact depends entirely on that backend's audience being broader than the agent data's intended audience.

This is a genuinely low-priority issue, and the signals agree. The vendor CVSS 4.0 base score is 2.3 (Low), with VC:L and VI:N/VA:N - a limited confidentiality-only impact and no integrity or availability effect. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood indicators are absent rather than elevated; per the precision rules this means no public exploit is identified. Critically, the vulnerability does not grant any new access: the leaked content (tool feedback, provider error bodies, runtime instructions, structured-output templates) is only visible to parties who can already read the configured telemetry/observability backend. The vendor's AT:P (Attack Requirement: Present) and PR:L correctly reflect that exploitation is contingent on both a specific defensive configuration (include_content=False) being in use AND an error/exception actually occurring, plus read access to the telemetry destination. The real-world risk is therefore confined to organizations that (a) deliberately enabled include_content=False to withhold sensitive content, and (b) export telemetry to a backend with a broader audience than the agent data itself - for those deployments this is a redaction-bypass/compliance gap rather than a remotely exploitable breach. The one caveat worth verifying: AV:N is assigned because telemetry backends are typically network-accessible, but the actual 'access' is to an observability system, not the agent - defenders should interpret the network vector in that light.

An organization running Pydantic AI sets InstrumentationSettings(include_content=False) specifically to keep user prompts and model outputs out of its shared observability platform, then grants its broader engineering or SRE team read access to that platform. When an agent tool fails (e.g., a ModelRetry or a provider error), the exception message, stack trace, error status description, and serialized model_request_parameters still flow to the backend, exposing runtime instructions, tool arguments/results, and structured-output templates to telemetry readers who were never meant to see agent content. No public exploit code exists; exploitation is passive observation of leaked trace data rather than an active attack.