PT-2026-55944 · Pydantic · Pydantic-Settings
Faze-Up
·
Published
2026-07-06
·
Updated
2026-07-06
·
CVE-2026-58203
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a configured secrets dir. When secrets nested subdir=True, a directory entry inside secrets dir that is a symbolic link pointing outside secrets dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets dir max size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This vulnerability is fixed in 2.14.2.
Exploit
Fix
Link Following
Resource Exhaustion
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pydantic-Settings