Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.
CVE-2026-15143
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-15143
Red Hat OpenShift AI 2.25
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI 2.25
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI 3.4
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI 3.4
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "985c6d5a4a84360ff8b447b94e4a3cdfbda3da90",
"versionType": "git"
}
],
"packageName": "guardrails-detectors",
"collectionURL": "https://github.com/trustyai-explainability/guardrails-detectors",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"versions": [
{
"status": "unaffected",
"version": "1791364320",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-built-in-detector-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"versions": [
{
"status": "unaffected",
"version": "1791367475",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"versions": [
{
"status": "unaffected",
"version": "1791537794",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-built-in-detector-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"versions": [
{
"status": "unaffected",
"version": "1791535841",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-15143
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #50129 · Revision 1
- Added to Heist Feed
- Publisher date