Riskcovery

CVE-2026-15143

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

State
Published
Severity
9.3 Critical
Published
Jul 10, 2026
Updated
Oct 22, 2026
Reserved
Jul 8, 2026

Read the record on cve.org

Description

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.

Scores

CVSSScoreVectorSource
3.19.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nredhat

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
guardrails-detectors
  • before 985c6d5a4a84360ff8b447b94e4a3cdfbda3da90Affected
Red Hat OpenShift AI 2.25Red Hat
  • 1791364320 and laterNot affected
Red Hat OpenShift AI 2.25Red Hat
  • 1791367475 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat
  • 1791537794 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat
  • 1791535841 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.