Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-15143

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

guardrails-detectors

Default version status: unaffected

  • 0 to < 985c6d5a4a84360ff8b447b94e4a3cdfbda3da90affected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1791364320 to < *unaffected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1791367475 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791537794 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791535841 to < *unaffected

References