PT-2026-57144 · Unknown+1 · Guardrails-Detectors+2

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-15378

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions guardrails-detectors (affected versions not specified) Red Hat Enterprise Linux (affected versions not specified) Red Hat OpenShift AI (affected versions not specified)

Description A flaw in the guardrails-detectors component allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This issue enables unauthorized access to sensitive information, such as credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. Furthermore, it allows for local file reads of critical data, including service account tokens and pod secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-15378

Affected Products

Red Hat

Red Hat Openshift

Guardrails-Detectors

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-15378 · Security Note
• https://reddit.com/r/redhat/comments/1uso8s8/psa_red_hat_ubuntu_linux_ssrf_and_local_file_read · Reddit Post
• https://access.redhat.com/security/cve/CVE-2026-15378 · Note
• https://twitter.com/OrizonCyber/status/2075550624880505079 · Twitter Post
• https://reddit.com/r/linuxadmin/comments/1uso8ts/psa_red_hat_ubuntu_linux_ssrf_and_local_file_read · Reddit Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2498941 · Note
• https://reddit.com/r/CVEWatch/comments/1uso85g/psa_red_hat_ubuntu_linux_ssrf_and_local_file_read · Reddit Post