CVE-2026-15378 | A flaw was found in the `guardrails-detectors` component. Th… | CVSS 9.3 CRITICAL

Description

A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. Additionally, it enables local file reads of critical data such as service account tokens and pod secrets.

Metadata

CVE ID: CVE-2026-15378
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-10 08:57 UTC
Published: 2026-07-10 09:29 UTC
Last updated: 2026-07-10 09:29 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: Red Hat / Red Hat OpenShift AI (RHOAI)
Sources: cve.org · NVD

Severity & Metrics

9.3 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Affected products (1)

Vendor	Product	Platform	Versions
Red Hat	Red Hat OpenShift AI (RHOAI)	—	—

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.3	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References (2)