EUVD-2026-42927
GHSA-34cr-c6hf-4xgc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Remote unauthenticated XSD input (AV:N/AC:L/PR:N/UI:N); SSRF crosses trust boundary (S:C) reading credentials/files (C:H), minor internal state change (I:L), no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.
AnalysisAI
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat OpenShift AI/RHOAI) allows a remote attacker to submit an arbitrary XML Schema Definition (XSD) that the parser resolves without restriction, coercing the server into fetching attacker-chosen URLs or reading local files. Because the CVSS vector is AV:N/PR:N/UI:N with a changed scope and high confidentiality impact (base score 9.3), an unauthenticated attacker can pivot into internal networks and harvest secrets such as cloud provider credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
The affected code is the file_type content detector within guardrails-detectors, the guardrails/input-validation tier of Red Hat OpenShift AI's LLM serving stack. The root cause is CWE-918 (Server-Side Request Forgery): when the detector validates or infers file type, it processes a user-supplied XSD schema, and XSD/XML schema processors will resolve external references (e.g. schemaLocation, xs:import/xs:include, or external entity-style URIs) unless explicitly hardened. Because those references are dereferenced by the server with the server's own network position and file-system privileges, an attacker controls the destination - arbitrary http(s) URLs (including cloud metadata endpoints like 169.254.169.254) or file:// paths - turning a schema-validation feature into a request-forgery and local-file-read primitive.
RemediationAI
No vendor-released patch version is identified at time of analysis - the provided references point to the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-15143) and Bugzilla 2498165, not to a tagged fixed release - so monitor those advisories and apply the RHOAI errata/updated guardrails-detectors image as soon as Red Hat publishes it. As compensating controls until then: disable or restrict the file_type content detector from accepting user-supplied XSD/XML schema input, and harden the XML/XSD parser to forbid external schema resolution and entity expansion (disable external schemaLocation, xs:import/include over the network, and file:// access), which prevents the SSRF primitive at the cost of rejecting schemas that legitimately reference external resources. Additionally, apply egress network controls on the detector pods - deny outbound access to cloud metadata endpoints (169.254.169.254), link-local, and internal RFC1918 ranges - accepting that this may break any legitimate outbound schema fetches, and restrict inbound access to the detector API to trusted callers only.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today