CVE-2026-58203

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Published

Jun 19, 2026, 10:10:42 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.18% · Oct 25, 2026

A flaw was found in the `pydantic-settings` component. When configured to handle nested secrets, this vulnerability allows an attacker to read sensitive files from outside the designated secrets directory. By placing a specially crafted symbolic link within the secrets directory, an attacker can trick the system into accessing unauthorized files. This issue also bypasses a safeguard designed to limit the size of loaded secrets, potentially leading to unexpected resource usage. This vulnerability requires an attacker to have the ability to modify entries within the secrets directory. pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size Moderate: This flaw in `pydantic-settings` allows for local file disclosure and bypass of size restrictions when `NestedSecretsSettingsSource` is used with `secrets_nested_subdir=True` and an attacker can influence entries in the configured `secrets_dir`. This is due to inconsistent directory traversal implementations that follow symbolic links outside the intended directory, enabling unauthorized reading of local files. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.