{"id":"CVE-2026-107293","aliases":["GHSA-3gh4-cghq-f8v4","PYSEC-2026-4274","PYSEC-2026-4283"],"url":"https://o3.security/vulnerability/CVE-2026-107293","summary":"Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`","details":"### Summary\n\nPydantic AI's OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.\n\nRetry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises `ModelRetry` — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. `NativeOutput` or `PromptedOutput`) and output validators applied to text output. Their full content was recorded on model request spans even with `include_content=False`. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.\n\n### Details\n\nRetry prompts without an associated tool call were serialized into span message attributes (such as `gen_ai.input.messages` and `pydantic_ai.all_messages`) as regular text parts, and this path did not apply the `include_content` check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.\n\n### Impact\n\nThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario `include_content=False` exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator `ModelRetry` messages.\n\n### Who Is Affected\n\nYou are affected if you enabled instrumentation with `include_content=False` and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as `NativeOutput` or `PromptedOutput`), or output validators on text output. You are not affected if you don't set `include_content=False`, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.\n\n### Remediation\n\nUpgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.\n\n### Workaround for Unpatched Versions\n\nIf you cannot upgrade, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.\n\n### Credits\n\nReported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.","published":"2026-10-08T16:57:24.841Z","modified":"2026-10-21T02:30:55.296654182Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"pydantic-ai","fixedVersion":"1.107.4"},{"ecosystem":"PyPI","name":"pydantic-ai","fixedVersion":"2.27.1"},{"ecosystem":"PyPI","name":"pydantic-ai-slim","fixedVersion":"1.107.4"},{"ecosystem":"PyPI","name":"pydantic-ai-slim","fixedVersion":"2.27.1"}],"fix":{"url":"https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f","label":"pydantic/pydantic-ai@fe9dbed"},"references":[{"type":"WEB","url":"https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107293.json"},{"type":"ADVISORY","url":"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107293"},{"type":"FIX","url":"https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f"},{"type":"FIX","url":"https://github.com/pydantic/pydantic-ai/pull/7357"},{"type":"PACKAGE","url":"https://github.com/pydantic/pydantic-ai"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:55.296654182Z"}}