{"id":"CVE-2026-58203","title":"pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max…","summary":"A flaw was found in the `pydantic-settings` component. When configured to handle nested secrets, this vulnerability allows an attacker to read sensitive files from outside the designated secrets directory. By placing a specially crafted sy…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["migration_toolkit_for_applications 8","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_virtualization 4","ai_inference_server 3.2"],"patched":["ai_inference_server 3.2"],"published":"2026-07-06","updated":"2026-10-09","sourceUpdated":"2026-10-09T16:31:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-58203"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497377"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58203"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58203"},{"url":"https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j"},{"url":"https://access.redhat.com/errata/RHSA-2026:73929"},{"url":"https://access.redhat.com/errata/RHSA-2026:73930"},{"url":"https://github.com/pydantic/pydantic-settings"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00185,"epssPercentile":0.07986,"aliases":["GHSA-4xgf-cpjx-pc3j"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:45.731Z","slug":"CVE-2026-58203","body":"## Overview\n\nA flaw was found in the `pydantic-settings` component. When configured to handle nested secrets, this vulnerability allows an attacker to read sensitive files from outside the designated secrets directory. By placing a specially crafted symbolic link within the secrets directory, an attacker can trick the system into accessing unauthorized files. This issue also bypasses a safeguard designed to limit the size of loaded secrets, potentially leading to unexpected resource usage. This vulnerability requires an attacker to have the ability to modify entries within the secrets directory.\n\n## Vendor advisories\n\n- **RHSA-2026:73929** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73929)\n- **RHSA-2026:73930** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73930)\n- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json)\n\n**pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size** — rated Moderate by Red Hat. Released 2026-07-06, updated 2026-10-09.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n\nFixed:\n\n- Red Hat AI Inference Server 3.2\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n\nNot affected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Red Hat Enterprise Linux command line assistant\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\n## Remediation\n\nFor more information visit https://access.redhat.com/errata/RHSA-2026:73929 https://access.redhat.com/errata/RHSA-2026:73929\nFor more information visit https://access.redhat.com/errata/RHSA-2026:73930 https://access.redhat.com/errata/RHSA-2026:73930\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, ensure that the `secrets_dir` used by `pydantic-settings` with `NestedSecretsSettingsSource` is exclusively controlled by the application, preventing any unauthorized modifications or symlink placements. Alternatively, disable the `secrets_nested_subdir=True` option if nested secret subdirectories are not essential for your application's functionality.\n\n## Package advisory (CVE-2026-58203)\n\nAffected packages:\n\n- `pydantic-settings >= 2.12.0, < 2.14.2`\n\nPatched in:\n\n- `pydantic-settings 2.14.2`\n\nSource: https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}