EUVD-2026-41878Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Write access to secrets_dir required (PR:L, AV:L); partial C/I/A since impact is limited to settings-loaded file contents and size-cap bypass.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 89 pypi packages depend on pydantic-settings (81 direct, 8 indirect)
Ecosystem-wide dependent count for version 2.12.0.
DescriptionCVE.org
pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets_dir_max_size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This vulnerability is fixed in 2.14.2.
AnalysisAI
Symlink traversal in pydantic-settings 2.12.0-2.14.1 allows a local low-privileged attacker with write access to the configured secrets directory to read arbitrary files from the host filesystem into application settings when secrets_nested_subdir=True. The same code path also bypasses the secrets_dir_max_size loading cap, undermining an advertised safety control. No public exploit or CISA KEV listing exists; the vendor-released fix is version 2.14.2.
Technical ContextAI
pydantic-settings is a Python configuration-management library built on Pydantic, commonly used in FastAPI and other modern Python applications to load secrets from files in a designated directory. The NestedSecretsSettingsSource component, when secrets_nested_subdir=True, recursively descends into subdirectories of secrets_dir to populate nested settings models. The root cause is CWE-22 (Path Traversal): the traversal logic follows symbolic links without validating that their resolved targets remain within the secrets_dir boundary, effectively breaking the directory jail. The affected CPE is cpe:2.3:a:pydantic:pydantic-settings:*:*:*:*:*:*:*:* for versions 2.12.0 through 2.14.1. A secondary consequence is that the same traversal bypasses the documented secrets_dir_max_size guard, meaning an attacker can also cause the application to ingest arbitrarily large files, defeating a defense-in-depth control.
RemediationAI
Upgrade pydantic-settings to version 2.14.2, the vendor-confirmed fix per the GitHub Security Advisory GHSA-4xgf-cpjx-pc3j (https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j). If an immediate upgrade is not feasible, disable the nested subdirectory feature by setting secrets_nested_subdir=False or omitting it from the source configuration; note this removes the ability to load hierarchically nested secrets from subdirectories. As an additional compensating control, mount secrets_dir as read-only or restrict write permissions to the owning application user only, preventing lower-privileged components from planting symlinks - this does not patch the traversal but removes the attacker's ability to create the malicious entry. Restricting secrets_dir to a dedicated ephemeral volume rather than a shared mount further limits lateral exposure in multi-tenant container environments.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functiona
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service vi
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebS
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client c
Pydantic is a data validation and settings management using Python type hinting. Rated high severity (CVSS 7.5), this vu
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny se
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthentica
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today