CVE-2026-15143
Critical
Description
A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.
SeverityCritical
CVSS9.3
Exploit probability—
ProductGuardrails-detectors
PublishedJul 10, 2026
First seenJul 10, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- guardrails-detectors985c6d5a4a84360ff8b447b94e4a3cdfbda3da90 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| guardrails-detectors | v < 985c6d5a4a84360ff8b447b94e4a3cdfbda3da90 | 985c6d5a4a84360ff8b447b94e4a3cdfbda3da90 |
| openshift_ai 2.25 | No range specified | — |
| openshift_ai 3.4 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.