CVE-2026-107293: Pydantic AI OpenTelemetry Instrumentation Content Exposure Vulnerability
Summary
CVE-2026-107293: Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetr... Affects pydantic-ai across 2 version ranges.
>= 0.3.4, < 1.107.4
>= 2.0.0b1, < 2.27.1
Fixed in 1.107.4 or 2.27.1, depending on the release line you run. How to fix ↓
Also tracked for
- pydantic-ai-slim · PyPI
The same CVE-2026-107293 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic AI is a library that provides OpenTelemetry instrumentation for monitoring AI applications. It allows developers to track interactions with AI models, including user prompts and model responses. The library includes settings to exclude sensitive content from telemetry data, ensuring that private information is not inadvertently shared with observability backends.
Vulnerability Detail
The vulnerability arises from the failure of Pydantic AI's OpenTelemetry instrumentation to redact retry prompt content when the setting include_content=False is enabled. This setting is intended to prevent sensitive information from being sent to telemetry backends. However, retry prompts, which provide feedback on validation errors, were not properly excluded from telemetry data when they were not associated with tool calls. As a result, sensitive information could be exposed in exported telemetry, particularly in scenarios where the telemetry destination is less trusted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.3.4, < 1.107.41.107.4pip install --upgrade "pydantic-ai==1.107.4" -
>= 2.0.0b1, < 2.27.12.27.1pip install --upgrade "pydantic-ai==2.27.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not possible, consider scrubbing or dropping the message attributes (gen_ai.input.messages, gen_ai.output.messages, pydantic_ai.all_messages) in your telemetry pipeline. This can be achieved using an OpenTelemetry Collector processor. Alternatively, switch to tool-based structured output modes, which correctly honor the include_content=False setting.
Conclusion
The CVE-2026-107293 vulnerability in Pydantic AI's OpenTelemetry instrumentation can lead to the unintended exposure of sensitive content in telemetry data. Users are advised to upgrade to the latest patched versions or implement workarounds to protect their data.
See every vulnerability recorded for pydantic-ai →
FAQ
The vulnerability may expose sensitive validation error details in telemetry data, which could be accessed by unauthorized users if the telemetry backend is not secure.
Users who have enabled instrumentation with include_content=False and generate retry prompts outside of tool calls are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
If upgrading is not feasible, implement the suggested workarounds to mitigate the risk of exposing sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic-ai.
