---
id: CVE-2026-58203
title: >-
  pydantic-settings: NestedSecretsSettingsSource follows symlinks outside
  secrets_dir, enabling local file read and bypassing secrets_dir_max…
summary: >-
  A flaw was found in the `pydantic-settings` component. When configured to
  handle nested secrets, this vulnerability allows an attacker to read sensitive
  files from outside the designated secrets directory. By placing a specially
  crafted sy…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - migration_toolkit_for_applications 8
  - openshift_lightspeed
  - ai_inference_server
  - ansible_automation_platform 2
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - openshift_virtualization 4
  - ai_inference_server 3.2
patched:
  - ai_inference_server 3.2
published: '2026-07-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T16:31:16+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-58203'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2497377'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-58203'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58203'
  - url: >-
      https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j
  - url: 'https://access.redhat.com/errata/RHSA-2026:73929'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73930'
  - url: 'https://github.com/pydantic/pydantic-settings'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00185
epssPercentile: 0.08149
aliases:
  - GHSA-4xgf-cpjx-pc3j
ecosystem: pip
ingestedAt: '2026-07-08T18:25:45.731Z'
---

## Overview

A flaw was found in the `pydantic-settings` component. When configured to handle nested secrets, this vulnerability allows an attacker to read sensitive files from outside the designated secrets directory. By placing a specially crafted symbolic link within the secrets directory, an attacker can trick the system into accessing unauthorized files. This issue also bypasses a safeguard designed to limit the size of loaded secrets, potentially leading to unexpected resource usage. This vulnerability requires an attacker to have the ability to modify entries within the secrets directory.

## Vendor advisories

- **RHSA-2026:73929** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73929)
- **RHSA-2026:73930** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73930)
- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58203.json)

**pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size** — rated Moderate by Red Hat. Released 2026-07-06, updated 2026-10-09.

Affected:

- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Virtualization 4

Fixed:

- Red Hat AI Inference Server 3.2

No fix planned:

- Red Hat Ansible Automation Platform 2
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Virtualization 4

Not affected:

- Exploit Intelligence
- Lightspeed Core
- Red Hat Enterprise Linux command line assistant
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat Satellite 6

## Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:73929 https://access.redhat.com/errata/RHSA-2026:73929
For more information visit https://access.redhat.com/errata/RHSA-2026:73930 https://access.redhat.com/errata/RHSA-2026:73930

Workarounds / mitigations:

- To mitigate this issue, ensure that the `secrets_dir` used by `pydantic-settings` with `NestedSecretsSettingsSource` is exclusively controlled by the application, preventing any unauthorized modifications or symlink placements. Alternatively, disable the `secrets_nested_subdir=True` option if nested secret subdirectories are not essential for your application's functionality.

## Package advisory (CVE-2026-58203)

Affected packages:

- `pydantic-settings >= 2.12.0, < 2.14.2`

Patched in:

- `pydantic-settings 2.14.2`

Source: https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j