CVE-2026-58203 Details
Description
pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a configured secrets_dir. When secrets_nested_subdir=True, a directory entry inside secrets_dir that is a symbolic link pointing outside secrets_dir is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented secrets_dir_max_size protection. An attacker or lower-privileged component able to influence entries in the configured secrets directory (for example, a writable or shared secrets mount) can turn this into an unintended local file read into settings and can defeat the advertised loading-size cap. This vulnerability is fixed in 2.14.2.
A local file read vulnerability has been identified in the Pydantic-Settings library, specifically in versions 2.12.0 prior to 2.14.2. The issue arises in the NestedSecretsSettingsSource component, which reads secret values from files within a specified secrets directory. When the secrets_nested_subdir option is enabled, the component follows symbolic links that point outside the secrets directory, allowing external files to be read into settings values. This behavior bypasses the documented secrets_dir_max_size limitation. An attacker or lower-privileged component that can manipulate entries in the secrets directory may exploit this vulnerability to read unintended files into settings, circumventing the size cap.
Upgrade to Pydantic-Settings version 2.14.2 or later. If an immediate upgrade is not possible, ensure that the secrets directory is fully controlled by the application and not writable by untrusted sources, or disable the secrets_nested_subdir option.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pydantic pydantic-settings | >= 2.12.0, < 2.14.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Reanalysis | [email protected] |
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |