CVE-2026-15378
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw in the `guardrails-detectors` component allows a remote attacker to perform a blind SSRF attack by submitting a crafted XSD string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. It also enables local file reads of critical data such as service account tokens and pod secrets.
Risk Assessment
The organization is at risk of leaking sensitive credentials and secrets, potentially leading to compromise of cloud resources and internal systems. The attack can be performed remotely without authentication, increasing the risk of privilege escalation and lateral movement within the internal network.
Recommendation
Immediately update the `guardrails-detectors` component to the latest patched version. Additionally, restrict access to internal network endpoints and implement input validation for XSD data.
Original NVD description (English source)
A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. Additionally, it enables local file reads of critical data such as service account tokens and pod secrets.