CVE-2026-58203 pydantic CVE debrief

Who should care

Users of pydantic-settings, especially those with shared or writable secrets mounts, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and restricting access to the configured secrets directory and monitoring for unusual activity in the secrets directory. The vulnerability is fixed in version 2.14.2.

Technical summary

The NestedSecretsSettingsSource in pydantic-settings reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, allowing files outside the configured directory to be read into settings values. This also bypasses the documented secrets_dir_max_size protection. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity.

Defensive priority

Medium priority due to CVSS score of 5.3 and potential for local file reads.

Recommended defensive actions

• Upgrade to version 2.14.2 or later
• Review and restrict access to the configured secrets directory
• Monitor for unusual activity in the secrets directory
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and affected versions. The vendor advisory provides mitigation steps. Evidence limits suggest that additional verification may be required to confirm affected scope and severity. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The vulnerability allows an attacker or lower-privileged component to influence entries in the configured secrets directory, potentially leading to unintended local file reads into settings values.

Official resources