CVE-2026-58203

pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets_dir_max_size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This vulnerability is fixed in 2.14.2.

• CWE-22
• CWE-59
• CWE-400

• https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3jExploit, Mitigation, Vendor Advisory
• https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3jExploit, Mitigation, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58189Apache Traffic Server allows redirect-limit bypass when plug…8.2
• CVE-2026-58191Appium is a cross-platform automation framework for all kind…6.1
• CVE-2026-58192Appium is a cross-platform automation framework for all kind…8.6
• CVE-2026-58195Agentic-Flow is an AI agent orchestration platform. Prior to…8.8
• CVE-2026-58198ChatterBot is a machine learning, conversational dialog engi…5.5
• CVE-2026-5820The Zypento Blocks plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-58207NATS Server is a high-performance server for NATS.io, the cl…6.5
• CVE-2026-58208NATS Server is a high-performance server for NATS.io, the cl…7.5
• CVE-2026-58209NATS Server is a high-performance server for NATS.io, the cl…4.3
• CVE-2026-5821The Image Optimizer plugin for WordPress is vulnerable to ar…8.1
• CVE-2026-58210NATS Server is a high-performance server for NATS.io, the cl…7.5
• CVE-2026-58211NATS Server is a high-performance server for NATS.io, the cl…5.4