EUVD-2026-42858
GHSA-85xg-h6rv-rgf5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Network-reachable XSD input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); SSRF reaching other systems changes scope (S:C) with high confidentiality (C:H), minor integrity (I:L), no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the guardrails-detectors component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. Additionally, it enables local file reads of critical data such as service account tokens and pod secrets.
Articles & Coverage 1
AnalysisAI
Server-Side Request Forgery in the guardrails-detectors component allows a remote attacker to submit a crafted XML Schema Definition (XSD) that forces the service to make attacker-directed requests, reaching cloud metadata services, the Kubernetes API, internal MinIO object storage, and other internal endpoints, and to read local files such as service account tokens and pod secrets. Because the flaw is blind SSRF chained to local file disclosure inside a container/Kubernetes context, an attacker can harvest credentials and pivot deeper into the cluster. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope-changing impact make this high priority for affected AI-guardrails deployments.
Technical ContextAI
guardrails-detectors is a Red Hat AI-safety component (associated with TrustyAI / OpenShift AI guardrails) that evaluates model inputs/outputs; here it parses user-supplied XSD (XML Schema Definition) content. CWE-918 (Server-Side Request Forgery) is the root cause: XML/XSD processors that resolve external references (schemaLocation, xs:import/xs:include, or entity resolution) will fetch attacker-controlled URIs when external resolution is not disabled. Because the parser runs inside a Kubernetes pod, the same feature that fetches remote URLs can also dereference file:// URIs, turning the SSRF into local file read of mounted secrets (e.g. /var/run/secrets/kubernetes.io/serviceaccount/token). The CVSS scope change (S:C) reflects that the vulnerable parser is abused to act against other security authorities - cloud metadata (169.254.169.254), the Kube API, and MinIO - beyond the component itself.
Affected ProductsAI
The affected software is the guardrails-detectors component as tracked by Red Hat (secalert@redhat.com) under CVE-2026-15378. No specific fixed or affected version numbers and no CPE strings were provided in the input, so exact version ranges cannot be confirmed here. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15378 and the tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=2498941 for the authoritative list of affected packages, product streams (e.g. Red Hat OpenShift AI / TrustyAI guardrails), and fixed builds once published.
RemediationAI
No vendor-released patch version is identified in the available data; monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-15378) and Bugzilla 2498941 (https://bugzilla.redhat.com/show_bug.cgi?id=2498941) and upgrade to the fixed guardrails-detectors build as soon as it is published. As compensating controls until patched: disable external entity and external schema resolution in the XML/XSD parser (harden the parser so xs:import/xs:include/schemaLocation and file:// resolution are rejected), which removes the SSRF vector with little functional loss since guardrail schemas rarely need remote fetches; enforce an egress NetworkPolicy on the pod to deny access to 169.254.169.254 (cloud metadata), the Kubernetes API, and MinIO from the detector workload, accepting that any legitimate internal calls must be explicitly allowlisted; and require IMDSv2 (hop-limit/token) on the node's metadata service to blunt credential theft. Additionally, minimize mounted secrets and disable automountServiceAccountToken on the pod where the token is not needed, noting that this may break in-cluster API calls the component legitimately makes.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today