All vulnerabilities
CVE-2026-107293GHSA-3gh4-cghq-f8v4PYSEC-2026-4274PYSEC-2026-4283

pydantic-ai: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

pydantic pydantic-aipipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.107.4Also 2.27.1GitHub
Published8 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 1.107.4pydantic-ai, pipGitHub
  • 2.27.1pydantic-ai, pipGitHub
  • 1.107.4pydantic-ai-slim, pipGitHub
  • 2.27.1pydantic-ai-slim, pipGitHub
  • 1.107.4pydantic-ai, PyPIOSVpip install "pydantic-ai>=1.107.4"
  • 2.27.1pydantic-ai, PyPIOSVpip install "pydantic-ai>=2.27.1"
Show all 8 fixed versions
  • 1.107.4pydantic-ai-slim, PyPIOSVpip install "pydantic-ai-slim>=1.107.4"
  • 2.27.1pydantic-ai-slim, PyPIOSVpip install "pydantic-ai-slim>=2.27.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.

Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises ModelRetry — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. NativeOutput or PromptedOutput) and output validators applied to text output. Their full content was recorded on model request spans even with include_content=False. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.

Details

Retry prompts without an associated tool call were serialized into span message attributes (such as gen_ai.input.messages and pydantic_ai.all_messages) as regular text parts, and this path did not apply the include_content check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.

Impact

This does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario include_content=False exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator ModelRetry messages.

Who Is Affected

You are affected if you enabled instrumentation with include_content=False and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as NativeOutput or PromptedOutput), or output validators on text output. You are not affected if you don't set include_content=False, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.

Remediation

Upgrade to a patched version; retry prompt content now honors include_content=False like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.

Workaround for Unpatched Versions

If you cannot upgrade, scrub or drop the message attributes (gen_ai.input.messages, gen_ai.output.messages, pydantic_ai.all_messages) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors include_content=False.

Credits

Reported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.

Text from GitHub Advisory Database

Affected versions 188

  • pydantic-ai, pip>= 0.3.4, < 1.107.4GitHub
  • pydantic-ai, pip>= 2.0.0b1, < 2.27.1GitHub
  • pydantic-ai-slim, pip>= 0.3.4, < 1.107.4GitHub
  • pydantic-ai-slim, pip>= 2.0.0b1, < 2.27.1GitHub
  • pydantic-aiaffected: >= 0.3.4, < 1.107.4CVE List
  • pydantic-aiaffected: >= 2.0.0b1, < 2.27.1CVE List
  • pydantic-ai-slimaffected: >= 0.3.4, < 1.107.4CVE List
  • pydantic-ai-slimaffected: >= 2.0.0b1, < 2.27.1CVE List
  • pydantic-ai, PyPIfrom 0.3.4, fixed in 1.107.4OSV
  • pydantic-ai, PyPI0.3.4OSV
  • pydantic-ai, PyPI0.3.5OSV
  • pydantic-ai, PyPI0.3.6OSV
  • pydantic-ai, PyPI0.3.7OSV
  • pydantic-ai, PyPI0.4.0OSV
  • pydantic-ai, PyPI0.4.1OSV
  • pydantic-ai, PyPI0.4.10OSV
  • pydantic-ai, PyPI0.4.11OSV
  • pydantic-ai, PyPI0.4.2OSV
  • pydantic-ai, PyPI0.4.3OSV
  • pydantic-ai, PyPI0.4.4OSV
  • pydantic-ai, PyPI0.4.5OSV
  • pydantic-ai, PyPI0.4.6OSV
  • pydantic-ai, PyPI0.4.7OSV
  • pydantic-ai, PyPI0.4.8OSV
  • pydantic-ai, PyPI0.4.9OSV
  • pydantic-ai, PyPI0.5.0OSV
  • pydantic-ai, PyPI0.5.1OSV
  • pydantic-ai, PyPI0.6.0OSV
  • pydantic-ai, PyPI0.6.1OSV
  • pydantic-ai, PyPI0.6.2OSV
  • pydantic-ai, PyPI0.7.0OSV
  • pydantic-ai, PyPI0.7.1OSV
  • pydantic-ai, PyPI0.7.2OSV
  • pydantic-ai, PyPI0.7.3OSV
  • pydantic-ai, PyPI0.7.4OSV
  • pydantic-ai, PyPI0.7.5OSV
  • pydantic-ai, PyPI0.7.6OSV
  • pydantic-ai, PyPI0.8.0OSV
  • pydantic-ai, PyPI0.8.1OSV
  • pydantic-ai, PyPI1.0.0OSV
  • pydantic-ai, PyPI1.0.0b1OSV
  • pydantic-ai, PyPI1.0.1OSV
  • pydantic-ai, PyPI1.0.10OSV
  • pydantic-ai, PyPI1.0.11OSV
  • pydantic-ai, PyPI1.0.12OSV
  • pydantic-ai, PyPI1.0.13OSV
  • pydantic-ai, PyPI1.0.14OSV
  • pydantic-ai, PyPI1.0.15OSV
  • pydantic-ai, PyPI1.0.16OSV
  • pydantic-ai, PyPI1.0.17OSV
  • pydantic-ai, PyPI1.0.18OSV
  • pydantic-ai, PyPI1.0.2OSV
  • pydantic-ai, PyPI1.0.3OSV
  • pydantic-ai, PyPI1.0.4OSV
  • pydantic-ai, PyPI1.0.5OSV
  • pydantic-ai, PyPI1.0.6OSV
  • pydantic-ai, PyPI1.0.7OSV
  • pydantic-ai, PyPI1.0.8OSV
  • pydantic-ai, PyPI1.0.9OSV
  • pydantic-ai, PyPIfrom 2.0.0b1, fixed in 2.27.1OSV
  • pydantic-ai, PyPI2.0.0OSV
  • pydantic-ai, PyPI2.0.0b1OSV
  • pydantic-ai, PyPI2.0.0b2OSV
  • pydantic-ai, PyPI2.0.0b3OSV
  • pydantic-ai, PyPI2.0.0b4OSV
  • pydantic-ai, PyPI2.0.0b5OSV
  • pydantic-ai, PyPI2.0.0b6OSV
  • pydantic-ai, PyPI2.0.0b7OSV
  • pydantic-ai, PyPI2.1.0OSV
  • pydantic-ai, PyPI2.10.0OSV
  • pydantic-ai, PyPI2.11.0OSV
  • pydantic-ai, PyPI2.12.0OSV
  • pydantic-ai, PyPI2.13.0OSV
  • pydantic-ai, PyPI2.14.0OSV
  • pydantic-ai, PyPI2.14.1OSV
  • pydantic-ai, PyPI2.15.0OSV
  • pydantic-ai, PyPI2.16.0OSV
  • pydantic-ai, PyPI2.17.0OSV
  • pydantic-ai, PyPI2.18.0OSV
  • pydantic-ai, PyPI2.19.0OSV
  • pydantic-ai, PyPI2.2.0OSV
  • pydantic-ai, PyPI2.20.0OSV
  • pydantic-ai, PyPI2.21.0OSV
  • pydantic-ai, PyPI2.22.0OSV
  • pydantic-ai, PyPI2.23.0OSV
  • pydantic-ai, PyPI2.24.0OSV
  • pydantic-ai, PyPI2.25.0OSV
  • pydantic-ai, PyPI2.26.0OSV
  • pydantic-ai, PyPI2.27.0OSV
  • pydantic-ai, PyPI2.3.0OSV
  • pydantic-ai, PyPI2.4.0OSV
  • pydantic-ai, PyPI2.5.0OSV
  • pydantic-ai, PyPI2.5.1OSV
  • pydantic-ai, PyPI2.6.0OSV
  • pydantic-ai, PyPI2.7.0OSV
  • pydantic-ai, PyPI2.8.0OSV
  • pydantic-ai, PyPI2.9.0OSV
  • pydantic-ai, PyPI2.9.1OSV
  • pydantic-ai-slim, PyPIfrom 0.3.4, fixed in 1.107.4OSV
  • pydantic-ai-slim, PyPI0.3.4OSV
  • pydantic-ai-slim, PyPI0.3.5OSV
  • pydantic-ai-slim, PyPI0.3.6OSV
  • pydantic-ai-slim, PyPI0.3.7OSV
  • pydantic-ai-slim, PyPI0.4.0OSV
  • pydantic-ai-slim, PyPI0.4.1OSV
  • pydantic-ai-slim, PyPI0.4.10OSV
  • pydantic-ai-slim, PyPI0.4.11OSV
  • pydantic-ai-slim, PyPI0.4.2OSV
  • pydantic-ai-slim, PyPI0.4.3OSV
  • pydantic-ai-slim, PyPI0.4.4OSV
  • pydantic-ai-slim, PyPI0.4.5OSV
  • pydantic-ai-slim, PyPI0.4.6OSV
  • pydantic-ai-slim, PyPI0.4.7OSV
  • pydantic-ai-slim, PyPI0.4.8OSV
  • pydantic-ai-slim, PyPI0.4.9OSV
  • pydantic-ai-slim, PyPI0.5.0OSV
  • pydantic-ai-slim, PyPI0.5.1OSV
  • pydantic-ai-slim, PyPI0.6.0OSV
  • pydantic-ai-slim, PyPI0.6.1OSV
  • pydantic-ai-slim, PyPI0.6.2OSV
  • pydantic-ai-slim, PyPI0.7.0OSV
  • pydantic-ai-slim, PyPI0.7.1OSV
  • pydantic-ai-slim, PyPI0.7.2OSV
  • pydantic-ai-slim, PyPI0.7.3OSV
  • pydantic-ai-slim, PyPI0.7.4OSV
  • pydantic-ai-slim, PyPI0.7.5OSV
  • pydantic-ai-slim, PyPI0.7.6OSV
  • pydantic-ai-slim, PyPI0.8.0OSV
  • pydantic-ai-slim, PyPI0.8.1OSV
  • pydantic-ai-slim, PyPI1.0.0OSV
  • pydantic-ai-slim, PyPI1.0.0b1OSV
  • pydantic-ai-slim, PyPI1.0.1OSV
  • pydantic-ai-slim, PyPI1.0.10OSV
  • pydantic-ai-slim, PyPI1.0.11OSV
  • pydantic-ai-slim, PyPI1.0.12OSV
  • pydantic-ai-slim, PyPI1.0.13OSV
  • pydantic-ai-slim, PyPI1.0.14OSV
  • pydantic-ai-slim, PyPI1.0.15OSV
  • pydantic-ai-slim, PyPI1.0.16OSV
  • pydantic-ai-slim, PyPI1.0.17OSV
  • pydantic-ai-slim, PyPI1.0.18OSV
  • pydantic-ai-slim, PyPI1.0.2OSV
  • pydantic-ai-slim, PyPI1.0.3OSV
  • pydantic-ai-slim, PyPI1.0.4OSV
  • pydantic-ai-slim, PyPI1.0.5OSV
  • pydantic-ai-slim, PyPI1.0.6OSV
  • pydantic-ai-slim, PyPI1.0.7OSV
  • pydantic-ai-slim, PyPI1.0.8OSV
  • pydantic-ai-slim, PyPI1.0.9OSV
  • pydantic-ai-slim, PyPIfrom 2.0.0b1, fixed in 2.27.1OSV
  • pydantic-ai-slim, PyPI2.0.0OSV
  • pydantic-ai-slim, PyPI2.0.0b1OSV
  • pydantic-ai-slim, PyPI2.0.0b2OSV
  • pydantic-ai-slim, PyPI2.0.0b3OSV
  • pydantic-ai-slim, PyPI2.0.0b4OSV
  • pydantic-ai-slim, PyPI2.0.0b5OSV
  • pydantic-ai-slim, PyPI2.0.0b6OSV
  • pydantic-ai-slim, PyPI2.0.0b7OSV
  • pydantic-ai-slim, PyPI2.1.0OSV
  • pydantic-ai-slim, PyPI2.10.0OSV
  • pydantic-ai-slim, PyPI2.11.0OSV
  • pydantic-ai-slim, PyPI2.12.0OSV
  • pydantic-ai-slim, PyPI2.13.0OSV
  • pydantic-ai-slim, PyPI2.14.0OSV
  • pydantic-ai-slim, PyPI2.14.1OSV
  • pydantic-ai-slim, PyPI2.15.0OSV
  • pydantic-ai-slim, PyPI2.16.0OSV
  • pydantic-ai-slim, PyPI2.17.0OSV
  • pydantic-ai-slim, PyPI2.18.0OSV
  • pydantic-ai-slim, PyPI2.19.0OSV
  • pydantic-ai-slim, PyPI2.2.0OSV
  • pydantic-ai-slim, PyPI2.20.0OSV
  • pydantic-ai-slim, PyPI2.21.0OSV
  • pydantic-ai-slim, PyPI2.22.0OSV
  • pydantic-ai-slim, PyPI2.23.0OSV
  • pydantic-ai-slim, PyPI2.24.0OSV
  • pydantic-ai-slim, PyPI2.25.0OSV
  • pydantic-ai-slim, PyPI2.26.0OSV
  • pydantic-ai-slim, PyPI2.27.0OSV
  • pydantic-ai-slim, PyPI2.3.0OSV
  • pydantic-ai-slim, PyPI2.4.0OSV
  • pydantic-ai-slim, PyPI2.5.0OSV
  • pydantic-ai-slim, PyPI2.5.1OSV
  • pydantic-ai-slim, PyPI2.6.0OSV
  • pydantic-ai-slim, PyPI2.7.0OSV
  • pydantic-ai-slim, PyPI2.8.0OSV
  • pydantic-ai-slim, PyPI2.9.0OSV
  • pydantic-ai-slim, PyPI2.9.1OSV

References 5