Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.
Published: 2026-10-08
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: Information Disclosure via Telemetry
Action: Patch Now
AI Analysis

Impact

The vulnerability causes sensitive agent content to be exported through OpenTelemetry exception events even when include_content=False. Exception events can reveal tool feedback, provider error bodies, runtime instructions, and structured-output templates, leading to unintended disclosure of protected data.

Affected Systems

Affected vendors include pydantic:pydantic-ai and pydantic:pydantic-ai-slim. All releases from 0.3.4 up to and including 1.107.6 and 2.44.0 are impacted. The issue is fixed in versions 1.107.6 and 2.44.0; older and other versions remain vulnerable.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity risk. No EPSS or KEV listing suggests low exploitation probability. Exploitation requires access to the telemetry backend to read exception logs; no code execution is involved. Deployments that avoid the include_content=False setting are not affected.

Generated by OpenCVE AI on October 8, 2026 at 17:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to v1.107.6 or v2.44.0
  • Restrict access to the telemetry backend so only authorized users can read logs
  • If an upgrade is not yet possible, disable exception event logging or scrub logs to remove sensitive information and rotate logs to eliminate exposed data
  • Review system configuration to ensure include_content is set correctly and not used in unintended contexts

Generated by OpenCVE AI on October 8, 2026 at 17:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4x9p-g9wm-8q7f Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
History

Thu, 08 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.
Title Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Weaknesses CWE-212
CWE-532
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-08T17:25:18.280Z

Reserved: 2026-10-07T15:53:23.586Z

Link: CVE-2026-107291

cve-icon Vulnrichment

Updated: 2026-10-08T17:25:13.936Z

cve-icon NVD

Status : Received

Published: 2026-10-08T17:17:14.590

Modified: 2026-10-08T18:17:17.023

Link: CVE-2026-107291

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T18:00:18Z

Weaknesses
  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer

  • CWE-532

    Insertion of Sensitive Information into Log File