CVE-2026-107291: Pydantic AI OpenTelemetry Instrumentation Exposes Sensitive Content in Exception Events
Summary
CVE-2026-107291: Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message c... Affects pydantic-ai across 2 version ranges.
>= 0.3.4, < 1.107.6
>= 2.0.0b1, < 2.44.0
Fixed in 1.107.6 or 2.44.0, depending on the release line you run. How to fix ↓
Also tracked for
- pydantic-ai-slim · PyPI
The same CVE-2026-107291 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic AI is a Python library that provides data validation and settings management using Python type annotations. It is widely used for building APIs and data models. The library includes OpenTelemetry instrumentation to monitor and trace application performance. However, a vulnerability exists that allows sensitive content to be exposed in telemetry data, even when configured to exclude such content.
Vulnerability Detail
The vulnerability arises from the OpenTelemetry instrumentation in Pydantic AI, which does not fully respect the 'include_content=False' setting. This leads to sensitive information, such as user prompts and model responses, being included in exported telemetry data. Specifically, exception events and error status descriptions can leak sensitive content, which could be accessed by unauthorized users if the telemetry data is sent to a less trusted observability backend. This exposure does not grant new access to the agent or its data but poses a risk when traces are shared with third-party vendors.
How To Fix
Latest published version: 2.60.0 as of 23 Oct 2026
pip install --upgrade "pydantic-ai==2.60.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.3.4, < 1.107.61.107.6pip install --upgrade "pydantic-ai==1.107.6" -
>= 2.0.0b1, < 2.44.02.44.0pip install --upgrade "pydantic-ai==2.44.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot upgrade, you can scrub the sensitive attributes from the telemetry data. Specifically, remove the 'exception.message', 'exception.stacktrace', error status descriptions, and the instruction parts and 'prompted_output_template' within 'model_request_parameters'. This can be done in your telemetry pipeline, for example, using an OpenTelemetry Collector processor. Additionally, setting 'include_model_request_parameters=False' alongside 'include_content=False' will remove both attributes, although it will also exclude other useful data.
Conclusion
The vulnerability CVE-2026-107291 in Pydantic AI's OpenTelemetry instrumentation can lead to the exposure of sensitive content in telemetry data. Users should upgrade to the patched versions or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for pydantic-ai →
FAQ
The vulnerability allows sensitive content to be exported in telemetry data, even when configured to exclude it.
Users who have enabled instrumentation with 'include_content=False' are affected, as sensitive information can be leaked.
The main risk is the exposure of sensitive information to unauthorized users if telemetry data is sent to untrusted destinations.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.3, indicating a low severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic-ai.
