Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P L N L N N 2.3 .0052 42.8 —
AFFECTED
Product Versions Fixed
pydantic-ai >= 0.3.4, < 1.107.6 – —
pydantic-ai-slim >= 0.3.4, < 1.107.6 – —
TIMELINE
Oct 7 Reserved by GitHub_M
Oct 8 Published (CNA: GitHub_M)
Oct 13 EXPLOIT PUBLISHED — CVE-2026-107291 (pydantic-ai). Public exploit reference added.
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 7, 2026 | Reserved | Reserved by GitHub_M |
| October 8, 2026 | Published | Published (CNA: GitHub_M) |
| October 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-107291 (pydantic-ai). Public exploit reference added. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| pydantic | pydantic-ai | — | >= 0.3.4, < 1.107.6 | — |
| pydantic | pydantic-ai-slim | — | >= 0.3.4, < 1.107.6 | — |
References (13)
- https://github.com/pydantic/pydantic-ai/commit/4e013c51a50659aba2adf7853bfb22bb77f6a518 [Patch]
- https://github.com/pydantic/pydantic-ai/commit/6b14c74cb281f899a2ae4fae5327111e33f60771 [Patch]
- https://github.com/pydantic/pydantic-ai/commit/7ee27e38ab2e525ca60ff1a25d16413ff989fd79 [Patch]
- https://github.com/pydantic/pydantic-ai/commit/963dec5f70d6f558997fc259356c0090cc5ea487 [Patch]
- https://github.com/pydantic/pydantic-ai/commit/de4e61515327bd80a19cd8552001c30933e6acc3 [Patch]
- https://github.com/pydantic/pydantic-ai/pull/8403 [Patch, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/pull/8404 [Patch, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/pull/8408 [Patch, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/pull/8428 [Patch, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/pull/8429 [Exploit, Patch, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 [Patch, Release Notes, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0 [Patch, Release Notes, Vendor Advisory]
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f [Mitigation, Vendor Advisory]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-107291 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
