CVE-2026-27953: ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection
Summary
CVE-2026-27953: ormar Pydantic Validation Bypass via pk_only and excluded Kwargs Injection in Model Constructor. Affects ormar versions < 0.23.1. Fixed in 0.23.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ormar is an asynchronous ORM (Object Relational Mapper) for Python that integrates seamlessly with FastAPI and Pydantic. It allows developers to define database models using Python classes, providing a simple and efficient way to interact with databases. ormar is designed to be user-friendly, enabling rapid development while ensuring data integrity and validation through Pydantic. However, a significant vulnerability has been identified that allows unauthenticated users to bypass critical validation checks, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability arises from a Pydantic validation bypass in ormar's model constructor, where the pk_only parameter can be injected into a JSON request body. This allows any unauthenticated user to skip all field validation checks, including type checks, constraints, and required-field checks. The unvalidated data can then be persisted to the database, leading to severe consequences such as privilege escalation, data integrity violations, and business logic bypass. The root cause is that the pk_only flag is extracted from user-supplied kwargs before any validation occurs, allowing attackers to manipulate the data being saved. Additionally, a secondary vulnerability exists with the excluded parameter, which can be used to nullify arbitrary fields during model construction.
How To Fix
Latest published version: 0.26.0 as of 23 Oct 2026
pip install --upgrade "ormar==0.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.1
This is the first release that contains the fix.
pip install --upgrade "ormar==0.23.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ormar models directly as FastAPI request body parameters. Instead, create a separate Pydantic model for request validation that does not expose the pk_only and excluded parameters.
Conclusion
The vulnerability CVE-2026-27953 in the ormar package poses significant risks to applications using its canonical integration with FastAPI. By allowing unauthenticated users to bypass validation, it can lead to serious data integrity issues. Updating to the patched version or implementing workarounds is essential to mitigate these risks.
See every vulnerability recorded for ormar →
FAQ
CVE-2026-27953 is a vulnerability in the ormar package that allows unauthenticated users to bypass Pydantic validation, leading to potential data integrity issues.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The consequences include privilege escalation, data integrity violations, and the ability to nullify critical fields in the database.
You can update the ormar package by running the command: pip install --upgrade ormar.
Yes, as a temporary workaround, avoid using ormar models directly in FastAPI request bodies and create separate Pydantic models for validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ormar.
