guardrails-detectors CVE-2026-15143

The concrete prerequisite is that the attacker can reach the guardrails-detectors service and submit input to the file_type content detector that accepts an arbitrary XSD/XML Schema string, which the detector then parses and resolves without disabling external references. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this requires no authentication and no user interaction against the exposed detector endpoint. Limiting factors: the guardrails-detectors file_type detector must be deployed and network-reachable by the attacker (in RHOAI it is a guardrails component that may sit behind internal service boundaries rather than the public internet), and the impact of SSRF depends on what internal URLs, metadata services, or files are reachable from the server's network position and privileges.

The signals are largely aligned toward high priority but incomplete. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, score 9.3) indicates remote, unauthenticated, low-complexity exploitation with scope change - consistent with SSRF that crosses a trust boundary into internal services. However, no EPSS score, no SSVC decision data, no KEV listing, and no POC were provided, so real-world exploitation likelihood cannot be quantified from the input; the absence of these should not be read as low risk, only as unmeasured. The confidentiality-heavy impact (C:H, I:L, A:N) matches an information-disclosure SSRF rather than direct RCE. Net: treat as a genuine high-priority patching candidate given the network-reachable, unauthenticated vector, while noting that active-exploitation status is unknown and EPSS is missing.

An attacker with network access to a guardrails-detectors endpoint submits content to the file_type detector containing a crafted XSD whose schema reference points at the cloud instance-metadata service or an internal-only URL. The server resolves the reference and returns or leaks the response, letting the attacker read cloud credentials or reach services that are not exposed externally; a second variant uses a file:// reference to read local files. No authentication or user interaction is required per the CVSS vector, and no public POC is currently identified.