Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend.
Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Vulnerable Products
pydantic:pydantic-ai
pydantic:pydantic-ai-slim
References 4
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4
https://github.com/pydantic/pydantic-ai/pull/7357
https://github.com/pydantic/pydantic-ai/pull/7357
https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441…
https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f
https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1
https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1