CVE-2026-58203: pydantic-settings Symlink Traversal in Nested Secrets Directory

Technical summary

The vulnerability exists in NestedSecretsSettingsSource, which reads secret values from files within a configured secrets_dir. When secrets_nested_subdir=True is set, the code fails to validate that directory entries are legitimate directories rather than symbolic links. By following symlinks without validation, an attacker can redirect file reads outside the intended secrets_dir boundary. Additionally, this code path bypasses the secrets_dir_max_size enforcement, allowing an attacker to load files larger than the documented protection limit. The vulnerability affects path traversal (CWE-22), uncontrolled resource consumption (CWE-400), and improper link resolution (CWE-59). The flaw is present in versions 2.12.0 through 2.14.1 and is resolved in 2.14.2.

Business impact

Organizations relying on pydantic-settings to manage application secrets and configuration are at risk if they enable the nested subdirectory feature. A malicious or compromised component with write access to the secrets directory can exfiltrate sensitive data—database credentials, API keys, encryption keys—into application memory. In containerized or multi-tenant environments where multiple services share a secrets mount, a lower-privileged service or attacker could exploit this to access secrets belonging to other applications. The bypass of size protections adds complexity to resource management and denial-of-service scenarios. This is particularly concerning in Kubernetes deployments using shared volumes or in CI/CD pipelines where build artifacts share storage.

Affected systems

The vulnerability affects pydantic-settings versions 2.12.0 through 2.14.1 inclusive. Any application using pydantic-settings with secrets_nested_subdir=True is vulnerable if the secrets directory is writable by untrusted processes or shared across multiple security domains. The vulnerability does not affect versions prior to 2.12.0 or version 2.14.2 and later. Applications that do not enable the nested subdirectory feature are not affected by this specific flaw.

Exploitability

Exploitation requires local access to the system and write permissions to the configured secrets directory. The attacker must create a symbolic link within the secrets_dir that points to a sensitive file outside that directory. When the application initializes or reloads its settings with secrets_nested_subdir=True enabled, it will follow the link and load the target file. The attack is reliable and does not require any user interaction or special timing. The CVSS score of 5.3 (Medium) reflects that exploitation requires local access and lower privileges but grants file read capabilities and can affect confidentiality, integrity (through configuration manipulation), and availability (through resource exhaustion via the size limit bypass).

Remediation

Upgrade pydantic-settings to version 2.14.2 or later. This version implements proper symlink detection and validation, preventing directory traversal attacks and restoring the secrets_dir_max_size protection. Organizations unable to upgrade immediately should disable the secrets_nested_subdir feature if it is not essential for their deployment model, and should restrict write access to the secrets directory to only trusted processes with appropriate security controls.

Patch guidance

Apply the upgrade to pydantic-settings 2.14.2 or later as soon as feasible. Verify the upgrade in development and staging environments before deploying to production. If the nested subdirectory feature is not in use, confirm it remains disabled (secrets_nested_subdir=False or not set) in your configuration. Check application logs and secrets-loading behavior post-upgrade to ensure no regressions. For organizations using dependency management tools, update your requirements.txt, pyproject.toml, or equivalent dependency manifest and re-run your build pipeline.

Detection guidance

Monitor the secrets directory for unexpected symbolic links or entries that do not match your documented configuration schema. Audit file access patterns to the secrets directory, particularly any attempts to read files outside its intended boundary. Review system logs for symlink creation events in shared or mounted secrets directories. In containerized environments, use volume mount options to prevent symlink traversal (e.g., mount with nosymfollow if your orchestrator supports it). Implement alerting on failed or unusual settings initialization events in application logs. A security scanner that validates dependency versions can identify vulnerable pydantic-settings versions in your codebase.

Why prioritize this

Although the CVSS score is Medium (5.3), this vulnerability should be prioritized for patching in environments where the nested subdirectory feature is actively used and the secrets directory is shared, writable, or accessible to multiple security domains. In Kubernetes, container orchestration, or shared hosting scenarios, the practical risk is elevated because attackers with lower privileges can abuse the feature. The bypass of size protections adds an additional attack surface. Organizations in highly restrictive environments where secrets directories are read-only to all but the application process can deprioritize slightly, but patching remains recommended as a best practice.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) is calculated using Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Unchanged, and impacts to Confidentiality, Integrity, and Availability of Low. This reflects that the attack requires local presence and some level of privilege to write to the secrets directory, but exploitation is straightforward and no user interaction is needed. The impact is bounded by local scope and file-read semantics, but in multi-tenant or shared environments, the practical risk is higher than the score suggests. Organizations should assess their specific deployment architecture when determining remediation urgency.

Frequently asked questions