CVE-2026-114386 pydantic CVE debrief

Who should care

Operators and users of Pydantic AI Harness before version 0.59.0 should assess their exposure and prioritize upgrading to mitigate this vulnerability. This includes reviewing and adjusting UsageLimits.tool_calls_limit settings, monitoring for suspicious activity, and verifying affected product deployments.

Why it matters

This vulnerability allows users or prompt-injected content to bypass tool call limits in Pydantic AI Harness, potentially leading to excessive resource usage or unauthorized actions.

• Verify and adjust UsageLimits.tool_calls_limit settings to prevent excessive tool calls
• Upgrade to version 0.59.0 or later to enforce tool call limits
• Monitor for suspicious activity that may indicate exploitation

Technical summary

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_calls, exceeding operator limits on costly or side-effecting tools. This vulnerability allows for potential excessive resource usage or unauthorized actions. Operators should prioritize upgrading to version 0.59.0 or later to mitigate this vulnerability.

Defensive priority

Operators should prioritize upgrading to version 0.59.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to version 0.59.0 or later
• Review and adjust UsageLimits.tool_calls_limit settings
• Monitor for suspicious activity
• Verify and adjust UsageLimits.tool_calls_limit settings to prevent excessive tool calls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the failure to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. This allows users or prompt-injected content to make the sandboxed program invoke tools via run_nested_call() without check_before_tool_calls. The affected product deployments should be reviewed to verify exposure, and operators should consider upgrading to version 0.59.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.