cyfenced.com →

[ CVE-2026-107291 · Published 8 Oct 2026 ]

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

CVSS 4.3 EPSS <1%Fix available

[ Description ]Official description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.

[ Fixes ]Fixes and patches

  • pydantic-ai 1.107.6Fixed version · GitHub Advisories · pip package pydantic-ai: upgrade to 1.107.6 or later (affected >= 0.3.4, < 1.107.6)
  • pydantic-ai 2.44.0Fixed version · GitHub Advisories · pip package pydantic-ai: upgrade to 2.44.0 or later (affected >= 2.0.0b1, < 2.44.0)
  • pydantic-ai-slim 1.107.6Fixed version · GitHub Advisories · pip package pydantic-ai-slim: upgrade to 1.107.6 or later (affected >= 0.3.4, < 1.107.6)
  • pydantic-ai-slim 2.44.0Fixed version · GitHub Advisories · pip package pydantic-ai-slim: upgrade to 2.44.0 or later (affected >= 2.0.0b1, < 2.44.0)
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

[ References ]References