# CVE-2026-107293: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` Source: https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-10-08. Updated: 2026-10-10 License: CC BY 4.0 with a link back CVE-2026-107293 · Severity: medium · CVSS 4 · Published 2026-10-08 Pydantic AI is a framework for building AI agents with structured validation. When configured to exclude sensitive content from telemetry exports via `include_content=False`, retry feedback messages sent back to the model were not properly redacted in certain modes. An attacker or authorized user with access to exported telemetry could view validation error details and model outputs that were supposed to be hidden. Technologies: [Pydantic AI](https://junglewise.ai/threats/technologies/pydantic-pydantic-ai), [Pydantic AI Slim](https://junglewise.ai/threats/technologies/ai-slim), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi). ## Quick answers **Is CVE-2026-107293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107293 being exploited in the wild. **How severe is CVE-2026-107293?** Medium severity, with a CVSS score of 4, published 8 October 2026. **Which products and versions are affected?** Pydantic AI 0.3.4 to <1.107.4, 2.0.0b1 to <2.27.1; Pydantic AI Slim 0.3.4 to <1.107.4, 2.0.0b1 to <2.27.1; pydantic-ai (PyPI) ECOSYSTEM:introduced=0.3.4,fixed=1.107.4,introduced=2.0.0b1,fixed=2.27.1; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=0.3.4,fixed=1.107.4,introduced=2.0.0b1,fixed=2.27.1. **Is there a fix for CVE-2026-107293?** Yes. pydantic-ai (PyPI): upgrade to 2.27.1 or later; pydantic-ai-slim (PyPI): upgrade to 2.27.1 or later. Until then: If you cannot upgrade, scrub or drop the message attributes (gen_ai.input.messages, gen_ai.output.messages, pydantic_ai.all_messages) in your telemetry pipeline using an OpenTelemetry Collector processor, or use tool-based structured output modes where retry feedback honors include_content=False. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-107293 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-107293?** Check whether you run Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - pydantic-ai (PyPI): upgrade to 2.27.1 or later ```sh pip install "pydantic-ai>=2.27.1" ``` - pydantic-ai-slim (PyPI): upgrade to 2.27.1 or later ```sh pip install "pydantic-ai-slim>=2.27.1" ``` If you cannot upgrade, scrub or drop the message attributes (gen_ai.input.messages, gen_ai.output.messages, pydantic_ai.all_messages) in your telemetry pipeline using an OpenTelemetry Collector processor, or use tool-based structured output modes where retry feedback honors include_content=False. ## Technical details The OpenTelemetry instrumentation failed to apply the include_content check to retry prompts (validation feedback) when they lacked an associated tool call, such as in structured output modes NativeOutput and PromptedOutput or when validators are applied to text output. These messages were serialized as regular text into span attributes without redaction, while tool-call-based retries and all other message content were correctly redacted. An attacker with access to the telemetry backend could read validation error messages that quote invalid model outputs. ## Affected products - Pydantic pydantic-ai 0.3.4 to <1.107.4, 2.0.0b1 to <2.27.1 - Pydantic pydantic-ai-slim 0.3.4 to <1.107.4, 2.0.0b1 to <2.27.1 ## Identifiers - CVE-2026-107293 - GHSA-3gh4-cghq-f8v4 - PYSEC-2026-4274 - PYSEC-2026-4283 ## Timeline - 2026-10-08: disclosed: Advisory published ## References - [https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4) - [https://github.com/pydantic/pydantic-ai/pull/7357](https://github.com/pydantic/pydantic-ai/pull/7357) ## Related threats - [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when) - [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching) - [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat) - [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited) - [Pydantic AI unbounded memory use in remote content download](https://junglewise.ai/threats/cve-2026-107294-pydantic-ai-unbounded-memory-use-when-downloading-remote-content)