Pydantic AI CVE-2026-107293

Exploitation requires a specific, non-default combination: (1) OpenTelemetry instrumentation enabled with InstrumentationSettings(include_content=False); (2) the agent must use a structured output mode that does NOT rely on tool calls (NativeOutput or PromptedOutput) or output validators applied to text output, so that retry prompts are generated outside of tool calls; and (3) the model must actually produce output that fails validation, triggering a retry prompt whose feedback quotes the invalid values. Disclosure is further limited to parties who can read the exported telemetry backend - it is not reachable by an external attacker against the agent. Deployments that do not set include_content=False, or whose retries all originate from tool calls (including the default tool-based structured output mode), are NOT affected, as those paths were redacted correctly.

This is a genuinely low-priority issue, and all available signals agree. The vendor-supplied CVSS 4.0 score is 2.3 (Low) with a vector (AV:N/AC:L/AT:P/PR:L/VC:L, all integrity/availability impacts None) indicating a limited confidentiality-only leak gated by an attack requirement (AT:P). No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified - consistent with a bug that has no real adversarial exploitation vector. Critically, the GHSA advisory states this 'does not grant an attacker any new access to the agent or its data'; the exposure is purely an information-handling defect (CWE-212) where sensitive retry-prompt content leaks into telemetry despite include_content=False. The only 'attacker' is someone already able to read the telemetry backend. The limited impact is amplified only in a specific, self-inflicted scenario: traces exported to a broader or less-trusted audience (third-party observability vendor or shared backend). There are no conflicting signals here - the low CVSS, absence of KEV/POC, and the vendor's own impact framing all point the same direction. The main caveat is that EPSS data is absent and POC status is simply unknown rather than confirmed negative, but neither would meaningfully raise priority for a privacy-regression of this nature.

An operator runs a Pydantic AI agent with InstrumentationSettings(include_content=False), expecting message content to be withheld from telemetry, and uses NativeOutput/PromptedOutput or an output validator on text output. When the model returns output that fails validation, Pydantic AI emits a retry prompt whose validation feedback quotes the model's invalid values; this feedback is recorded in full on the request span (gen_ai.input.messages / pydantic_ai.all_messages). Anyone with read access to the observability backend - e.g. a third-party monitoring vendor - can then see content the operator believed was redacted. No public exploit code was identified; exploitation requires no attacker action against the agent itself.