Pydantic AI v2.58.0 fixes two medium-severity vulnerabilities: the Vercel AI and AG-UI adapters can bypass model-executed tool calls, and MCP credentials enter OpenTelemetry traces
AI summary
Pydantic AI released v2.58.0, fixing two medium-severity security issues. According to GHSA-xv4x-g8mx-ch56, provider native MCP configuration may write server URLs, authorization tokens, and custom header values into OpenTelemetry request traces even when include_content=False is set, and URL-based MCP capabilities may also leak credentials embedded in URL-derived identifiers; the issue was fixed in v2.58.0 and v1.107.8, and the official recommendation is to restrict access to historical traces and rotate exposed credentials.
Why it was selected
The announcement states that even when content recording is turned off, MCP tokens still enter traces, and teams using these two adapters can use this to check historical traces and rotate credentials.