ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "__pk_only__": true into a JSON request body. By injecting "__pk_only__": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8d549898-3598-11f1-a8bc-3c7c3fba4204 advisory.

    https://github.com/ormar-orm/ormar/security/advisories reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation
    bypass through the model constructor, allowing any unauthenticated user to skip all field validation by
    injecting "__pk_only__": true into a JSON request body. By injecting "__pk_only__": true into a JSON
    request body, an unauthenticated attacker can skip all field validation and persist unvalidated data
    directly to the database. A secondary __excluded__ parameter injection uses the same pattern to
    selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's
    canonical FastAPI integration pattern recommended in its official documentation, enabling privilege
    escalation, data integrity violations, and business logic bypass in any application using ormar.Model
    directly as a request body parameter. This issue has been fixed in version 0.23.1. (CVE-2026-27953)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation     bypass through the model constructor, allowing any unauthenticated user to skip all field validation by     injecting __pk_only__: true into a JSON request body. By injecting __pk_only__: true into a JSON     request body, an unauthenticated attacker can skip all field validation and persist unvalidated data     directly to the database. A secondary __excluded__ parameter injection uses the same pattern to     selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's     canonical FastAPI integration pattern recommended in its official documentation, enabling privilege     escalation, data integrity violations, and business logic bypass in any application using ormar.Model     directly as a request body parameter. This issue has been fixed in version 0.23.1. (CVE-2026-27953)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306040	FreeBSD : py-ormar -- vulnerabilities (8d549898-3598-11f1-a8bc-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	critical
439104	SCA: security update for ormar (GHSA-f964-whrq-44h8)	Tenable Cloud Security	SCA Checks	critical
439104	SCA: security update for ormar (GHSA-f964-whrq-44h8)	Tenable Self-Hosted Container Security	SCA Checks	critical
303256	Linux Distros Unpatched Vulnerability : CVE-2026-27953	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-27953

critical

Tenable Plugins

critical

critical

critical

critical