CVE-2026-58203: pydantic-settings Path Traversal Flaw

CVE-2026-58203 Overview

CVE-2026-58203 is a path traversal vulnerability [CWE-22] affecting the pydantic-settings Python library, which provides settings management using Pydantic. The flaw exists in NestedSecretsSettingsSource when secrets_nested_subdir=True is configured. The component follows symbolic links inside the configured secrets_dir that point outside the directory, reading arbitrary files into settings values. The same code path bypasses the secrets_dir_max_size protection. Versions from 2.12.0 up to 2.14.2 are affected, and the issue is fixed in 2.14.2.

Critical Impact
An attacker or lower-privileged component able to place symlinks in the secrets directory can read arbitrary local files into application settings and bypass the advertised loading-size cap.

Affected Products

pydantic-settings 2.12.0 through versions prior to 2.14.2
Python applications using NestedSecretsSettingsSource with secrets_nested_subdir=True
Deployments with writable or shared secrets mounts influenced by lower-privileged components

Discovery Timeline

2026-07-06 - CVE-2026-58203 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-58203

Vulnerability Analysis

The pydantic-settings library loads secrets from files placed in a configured secrets_dir. Each file name maps to a settings field, and the file content becomes the field value. When secrets_nested_subdir=True is enabled, NestedSecretsSettingsSource walks subdirectories inside secrets_dir to support nested settings structures.

The directory traversal logic follows symbolic links without verifying that the resolved target remains inside secrets_dir. A symlink entry pointing to a path outside the configured directory causes the source to open and read that external file into settings values. The same traversal path skips the secrets_dir_max_size accounting, defeating the size cap that limits how much data can be loaded from the secrets directory.

Root Cause

The root cause is missing canonical path validation in the nested secrets loader. The code follows symlinks by default and does not compare the resolved real path against the configured secrets_dir boundary. Size accounting is also skipped along this branch, so the secrets_dir_max_size limit does not apply to files reached through nested traversal.

Attack Vector

Exploitation requires local access with permission to create entries in the configured secrets directory, such as a container sidecar, a co-tenant on a shared secrets mount, or a lower-privileged process writing to a writable volume. The attacker creates a symlink inside secrets_dir whose name matches an expected settings field and whose target is a sensitive file such as /etc/passwd, a private key, or a token file readable by the application process. When the application initializes settings, the file contents are read into the corresponding field and may be logged, transmitted, or otherwise exposed by application logic. The same technique loads arbitrarily large files by bypassing secrets_dir_max_size.

Detection Methods for CVE-2026-58203

Indicators of Compromise

Symbolic links inside any directory configured as secrets_dir whose targets resolve outside that directory.
Application logs showing settings field values that match the contents of unrelated system files.
Unexpected memory growth or slow startup caused by loading of large files reached through nested symlink traversal.

Detection Strategies

Inventory Python dependencies and flag installations of pydantic-settings at versions 2.12.0 through 2.14.1.
Audit application configurations for NestedSecretsSettingsSource usage with secrets_nested_subdir=True.
Scan mounted secrets directories at deploy time for symlink entries and report any whose real path exits the configured root.

Monitoring Recommendations

Enable file access auditing on hosts and containers for reads originating from application processes against paths outside declared secrets mounts.
Alert on process reads of sensitive files such as /etc/shadow, SSH private keys, or cloud credential files by services that only require scoped secrets.
Track dependency changes in CI so upgrades or downgrades of pydantic-settings are visible to security teams.

How to Mitigate CVE-2026-58203

Immediate Actions Required

Upgrade pydantic-settings to version 2.14.2 or later in all environments.
Set secrets_nested_subdir=False where nested secrets are not required until the upgrade is deployed.
Remove or restrict write access to shared secrets mounts so untrusted components cannot place symlinks in secrets_dir.

Patch Information

The issue is fixed in pydantic-settings 2.14.2. See the GitHub Security Advisory GHSA-4xgf-cpjx-pc3j for maintainer guidance and the corresponding fix commit.

Workarounds

Disable secrets_nested_subdir and use a flat secrets_dir layout until upgrading.
Mount secrets_dir as read-only for the application and ensure only trusted orchestration components can write to it.
Pre-validate the secrets directory at startup by rejecting any entry whose real path is not a descendant of the configured root.

bash

# Configuration example
pip install --upgrade 'pydantic-settings>=2.14.2'

# Verify no symlinks escape the secrets directory
find /run/secrets -type l -exec sh -c '\
  target=$(readlink -f "$1"); \
  case "$target" in /run/secrets/*) ;; *) echo "escape: $1 -> $target";; esac' _ {} \;