{"schema":"threatline.record/2","record":{"id":"CVE-2026-107293","aliases":["GHSA-3gh4-cghq-f8v4","PYSEC-2026-4274","PYSEC-2026-4283"],"summary":"Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`","details":"### Summary\n\nPydantic AI's OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.\n\nRetry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises `ModelRetry` — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. `NativeOutput` or `PromptedOutput`) and output validators applied to text output. Their full content was recorded on model request spans even with `include_content=False`. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.\n\n### Details\n\nRetry prompts without an associated tool call were serialized into span message attributes (such as `gen_ai.input.messages` and `pydantic_ai.all_messages`) as regular text parts, and this path did not apply the `include_content` check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.\n\n### Impact\n\nThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario `include_content=False` exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator `ModelRetry` messages.\n\n### Who Is Affected\n\nYou are affected if you enabled instrumentation with `include_content=False` and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as `NativeOutput` or `PromptedOutput`), or output validators on text output. You are not affected if you don't set `include_content=False`, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.\n\n### Remediation\n\nUpgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.\n\n### Workaround for Unpatched Versions\n\nIf you cannot upgrade, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.\n\n### Credits\n\nReported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.","categories":["Libraries & packages"],"product":"pydantic-ai","vendor":"pydantic","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"range":">= 0.3.4, < 1.107.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"range":">= 2.0.0b1, < 2.27.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"range":">= 0.3.4, < 1.107.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"range":">= 2.0.0b1, < 2.27.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107293","source_modified_at":"2026-10-08T17:14:30.659Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"pydantic-ai","vendor":"pydantic","versions":[{"version":">= 0.3.4, < 1.107.4","status":"affected"},{"version":">= 2.0.0b1, < 2.27.1","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107293","source_modified_at":"2026-10-08T17:14:30.659Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"pydantic-ai-slim","vendor":"pydantic","versions":[{"version":">= 0.3.4, < 1.107.4","status":"affected"},{"version":">= 2.0.0b1, < 2.27.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"ranges":[{"events":[{"introduced":"0.3.4"},{"fixed":"1.107.4"}],"type":"ECOSYSTEM"}],"versions":["0.3.4","0.3.5","0.3.6","0.3.7","0.4.0","0.4.1","0.4.10","0.4.11","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.8.0","0.8.1","1.0.0","1.0.0b1","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"ranges":[{"events":[{"introduced":"2.0.0b1"},{"fixed":"2.27.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"ranges":[{"events":[{"introduced":"0.3.4"},{"fixed":"1.107.4"}],"type":"ECOSYSTEM"}],"versions":["0.3.4","0.3.5","0.3.6","0.3.7","0.4.0","0.4.1","0.4.10","0.4.11","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.8.0","0.8.1","1.0.0","1.0.0b1","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"ranges":[{"events":[{"introduced":"2.0.0b1"},{"fixed":"2.27.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"version":"1.107.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"version":"2.27.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"version":"1.107.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-08T17:16:33Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"version":"2.27.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"version":"1.107.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"version":"2.27.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"version":"1.107.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","source_modified_at":"2026-10-15T14:56:22.971904466Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"version":"2.27.1"}],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00297,"percentile":0.21211,"score_date":"2026-10-23"},"published_at":"2026-10-08T16:57:24.841Z","modified_at":"2026-10-15T14:56:22.971904466Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T17:16:33Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107293","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-08T17:14:30.659Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-3gh4-cghq-f8v4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:56:22.971904466Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107293","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/pull/7357","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-08T17:14:19.566455Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:22.971904466Z","content_hash":"81271da598f94b51cefc37d6f4fb3a68361c757d52899b56bac8f72d676ce82b"}}