CVE-2026-114386: Pydantic AI Harness: tool-call limit bypass in CodeMode

Q: Is CVE-2026-114386 actively exploited?

No confirmed active exploitation of CVE-2026-114386 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-114386?

1) Upgrade pydantic-ai-harness to 0.59.0 or later (fix in pydantic/pydantic-ai PR #10362, commit eb27b2b). 2) Until patched, disable the CodeMode toolset or remove costly and side-effecting tools from agents that use it. 3) Enforce limits independently of the framework: provider-side budgets, API gateway rate limits, per-tool quotas and idempotency controls. 4) Require human approval for destructive or high-cost tools. 5) Detect by alerting on tool-call counts per run that exceed the configured tool_calls_limit, on spend anomalies, and on bursts of calls from a single run_code execution. 6) Treat untrusted content reaching agents with CodeMode as a prompt-injection risk and sanitize or isolate it.

Q: What systems are affected by CVE-2026-114386?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, code-executing agents (CodeMode), tool-calling LLM pipelines, multi-tool orchestration.

Q: What is the CVSS score for CVE-2026-114386?

CVE-2026-114386 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.35%.

GHSA-3589-pxp7-3gj8MEDIUM

Published October 21, 2026

CISO Take

Pydantic AI Harness before 0.59.0 does not enforce UsageLimits.tool_calls_limit on nested tool calls made from run_code in the CodeMode toolset, so a sandboxed program (or prompt-injected content steering it) can call tools through run_nested_call() without the pre-call check. This is a medium-severity issue (CVSS 4.8, high attack complexity) with no EPSS score, no KEV listing, no public exploit and no Nuclei template, so mass exploitation is unlikely today. The real exposure is cost and side effects: agents wired to expensive APIs or tools that write, send or delete can exceed the operator's limits, which many teams treat as their main guardrail against runaway spend. The package has about 505 downstream dependents and 16 other CVEs, so it sits in a lot of agent stacks and is worth tracking. Upgrade to 0.59.0 or later, and in the meantime enforce quotas outside the agent, at the tool, API-gateway or provider-billing layer, rather than relying on the framework counter.

Sources:NVDGitHub AdvisoryVulnCheckATLASpydantic.dev GitHub repository

What is the risk?

Low-to-medium. CVSS 4.8 reflects network reachability with high complexity, no privileges or user interaction, and limited integrity and availability impact. Exploitation needs the CodeMode toolset to be enabled and a way to influence the code the agent runs, such as direct user access or indirect prompt injection. There is no known active exploitation, KEV listing, public exploit or scanner template, and EPSS data is unavailable. Risk rises sharply where the exposed tools have real-world side effects or cost, because the bypass removes the safeguard operators set for them.

How does the attack unfold?

Initial Access

Attacker supplies input or plants prompt-injected content that reaches an agent using the CodeMode toolset.

AML.T0051.001

Tool Invocation

The agent runs a program via run_code that calls tools through run_nested_call(), skipping check_before_tool_call.

AML.T0053

Limit Bypass

UsageLimits.tool_calls_limit is never enforced on the nested calls, so the program makes far more calls than allowed.

Impact

Excess calls to costly or side-effecting tools drive up spend, exhaust quotas or repeat unwanted actions.

AML.T0034.002

Initial Access

Attacker supplies input or plants prompt-injected content that reaches an agent using the CodeMode toolset.

AML.T0051.001

Tool Invocation

The agent runs a program via run_code that calls tools through run_nested_call(), skipping check_before_tool_call.

AML.T0053

Limit Bypass

UsageLimits.tool_calls_limit is never enforced on the nested calls, so the program makes far more calls than allowed.

Impact

Excess calls to costly or side-effecting tools drive up spend, exhaust quotas or repeat unwanted actions.

AML.T0034.002

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Pydantic AI	pip	—	No patch
20.8K505 dependentsPushed 6d ago94% patched~70d to patchFull package profile →
Pydantic AI	pip	< 0.59.0	`0.59.0`
20.8K505 dependentsPushed 6d ago94% patched~70d to patchFull package profile →

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

1) Upgrade pydantic-ai-harness to 0.59.0 or later (fix in pydantic/pydantic-ai PR #10362, commit eb27b2b). 2) Until patched, disable the CodeMode toolset or remove costly and side-effecting tools from agents that use it. 3) Enforce limits independently of the framework: provider-side budgets, API gateway rate limits, per-tool quotas and idempotency controls. 4) Require human approval for destructive or high-cost tools. 5) Detect by alerting on tool-call counts per run that exceed the configured tool_calls_limit, on spend anomalies, and on bursts of calls from a single run_code execution. 6) Treat untrusted content reaching agents with CodeMode as a prompt-injection risk and sanitize or isolate it.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSPrompt InjectionFrameworkAgentPluginAML.T0034.002- Agentic Resource Consumption AML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to unknown risks and manage AI system failure modes

OWASP LLM Top 10

LLM06-Excessive AgencyLLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-114386?

Is CVE-2026-114386 actively exploited?

No confirmed active exploitation of CVE-2026-114386 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114386?

1) Upgrade pydantic-ai-harness to 0.59.0 or later (fix in pydantic/pydantic-ai PR #10362, commit eb27b2b). 2) Until patched, disable the CodeMode toolset or remove costly and side-effecting tools from agents that use it. 3) Enforce limits independently of the framework: provider-side budgets, API gateway rate limits, per-tool quotas and idempotency controls. 4) Require human approval for destructive or high-cost tools. 5) Detect by alerting on tool-call counts per run that exceed the configured tool_calls_limit, on spend anomalies, and on bursts of calls from a single run_code execution. 6) Treat untrusted content reaching agents with CodeMode as a prompt-injection risk and sanitize or isolate it.

What systems are affected by CVE-2026-114386?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, code-executing agents (CodeMode), tool-calling LLM pipelines, multi-tool orchestration.

What is the CVSS score for CVE-2026-114386?

CVE-2026-114386 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscode-executing agents (CodeMode)tool-calling LLM pipelinesmulti-tool orchestration

MITRE ATLAS Techniques

AML.T0034.002Agentic Resource Consumption

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06, LLM10

What are the technical details?

Original Advisory

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

Exploitation Scenario

An organization runs an internal research agent with CodeMode and a paid enrichment API, with tool_calls_limit set to 20. An attacker plants instructions in a web page or document the agent ingests, telling it to write a program that loops over thousands of lookups. The program runs in run_code and calls the tool through run_nested_call(), skipping the pre-call limit check. The agent makes thousands of paid or side-effecting calls in one run, exhausting budget and quotas, or repeatedly triggering a write action such as creating records or sending messages, until an external control stops it.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.