CVE-2026-58203

Name of the Vulnerable Software and Affected Versions pydantic-settings versions 2.12.0 through 2.14.1

Description The NestedSecretsSettingsSource reads secret values from files within a configured secrets dir. When the secrets nested subdir variable is set to true, the system follows symbolic links within the secrets dir that point to locations outside that directory, allowing files from external paths to be read into settings values. This process also bypasses the secrets dir max size protection, which is intended to cap the loading size. An attacker or a lower-privileged component with the ability to modify entries in the configured secrets directory, such as through a writable or shared secrets mount, can exploit this to perform an unintended local file read and circumvent the size limit.

Recommendations Update pydantic-settings to version 2.14.2.