CVE-2026-27953Patch(collerek / ormar)

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch collerek ormar systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "__pk_only__": true into a JSON request body. By injecting "__pk_only__": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.

collerek CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

https://github.com/ormar-orm/ormar/releases/tag/0.23.1

Weakness type (CWE)

CWE-20CWE-915

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ormar

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
Peaked at 3 mentions on most recent observed day (2026-03-29)
5 total mentions across 2 days

Affected systems

Vendors

collerek

Products

ormar

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Patch

360.0%

Disclosure

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-23	2	Disclosure2
2026-03-29	3	Patch3

Full discourse5 posts

White Rabbitx@TheRabbitPy194d
Patch
🔑 CVE-2026-27953 (ormar <=0.23.0 Python ORM): 9.8 CVSS Pydantic bypass via _pk_only_—RCE, corruption. Patch: 0.23.1+ https://github.com/columbia-ard/ormar/security/advisories/GHSA-xxxx https://nvd.nist.gov/vuln/detail/CVE-2026-27953 https://feedly.com/cve/CVE-2026-27953
Post summary
CVE-2026-27953 is a critical RCE vulnerability in ormar <=0.23.0; it is fixed by upgrading to 0.23.1+ and no PoC, exploit tool, or active exploitation is reported.
1000065
492 followersView on X
White Rabbitx@TheRabbitPy195d
Patch
🐍 CVE-2026-27953 (ormar <=0.23.0 Python ORM): 9.8 CVSS Pydantic bypass via _pk_only_ in constructor—RCE, data corruption. Patch: 0.23.1+ https://nvd.nist.gov/vuln/detail/CVE-2026-27953
Post summary
The tweet announces the CVE details for CVE-2026-27953, confirms an available patch version (0.23.1+), and provides technical specifics about the RCE vulnerability.
1000071
492 followersView on X
White Rabbitx@TheRabbitPy195d
Patch
🚨 CVE-2026-27953 (ormar Python ORM): Critical 9.8 CVSS Pydantic validation bypass via model constructor—RCE risk for any unauth user. Patch to 0.23.1+ now! https://nvd.nist.gov/vuln/detail/CVE-2026-27953
Post summary
CVE-2026-27953 is a critical RCE flaw in ormar due to a Pydantic validation bypass; the community is advised to upgrade to 0.23.1+.
1000064
492 followersView on X
Infoflowcloud@infoflowcloud201d
Disclosure
🚨*CVE* CVE-2026-27953 ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticat… https://www.cve.org/CVERecord?id=CVE-2026-27953 ----- Traducción: CVE-2026-27953 o a… http://infoflow.cloud`
Post summary
The post announces CVE-2026-27953, a Pydantic validation bypass vulnerability in the Python ORM ormar affecting versions 0.23.0 and earlier.
0000033
61 followersView on X
CVE@CVEnew201d
Disclosure
CVE-2026-27953 ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticat… https://www.cve.org/CVERecord?id=CVE-2026-27953
Post summary
CVE-2026-27953 is a newly published vulnerability in the ormar async mini ORM for Python, allowing Pydantic validation bypass via the model constructor, which could lead to unauthorized access.
00000159
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	collerek	ormar	-	python	-

Explore more

Back to dashboard collerek CVEs ormar vulnerabilities

What researchers are saying

CVE-2026-27953

White Rabbitx[verified]@TheRabbitPyPatch

CVE-2026-27953 is a critical RCE vulnerability in ormar <=0.23.0; it is fixed by upgrading to 0.23.1+ and no PoC, exploit tool, or active exploitation is reported.

White Rabbitx[verified]@TheRabbitPyPatch

The tweet announces the CVE details for CVE-2026-27953, confirms an available patch version (0.23.1+), and provides technical specifics about the RCE vulnerability.

White Rabbitx[verified]@TheRabbitPyPatch

CVE-2026-27953 is a critical RCE flaw in ormar due to a Pydantic validation bypass; the community is advised to upgrade to 0.23.1+.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-27953, a Pydantic validation bypass vulnerability in the Python ORM ormar affecting versions 0.23.0 and earlier.

CVE@CVEnewDisclosure

CVE-2026-27953 is a newly published vulnerability in the ormar async mini ORM for Python, allowing Pydantic validation bypass via the model constructor, which could lead to unauthorized access.