guardrails-detectors vulnerabilities
3 known CVE vulnerabilities in guardrails-detectors, translated and rated.
- CVE-2026-15143Critical
A flaw was found in the file_type content detector of guardrails-detectors, allowing a remote attacker to supply an arbitrary XSD string processed without restrictions. This can lead to server-side requests to arbitrary URLs or local file reads.
- CVE-2026-15378Critical
A flaw in the `guardrails-detectors` component allows a remote attacker to perform a blind SSRF attack by submitting a crafted XSD string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. It also enables local file reads of critical data such as service account tokens and pod secrets.
- CVE-2026-15154Medium
A ReDoS vulnerability was found in the `guardrails-detectors` component of Red Hat OpenShift AI. A remote attacker can send crafted regular expressions to the public detection API, causing catastrophic backtracking and 100% CPU usage by a worker process.