PT-2026-57201 · Red Hat+1 · Openshift Ai+1

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-15143

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions guardrails-detectors (affected versions not specified)

Description A flaw exists in the file type content detector that allows a remote attacker to provide an arbitrary XML Schema Definition (XSD) string. Because the XSD is processed without proper restrictions, it can lead to Server-Side Request Forgery (SSRF), where the server is forced to make requests to arbitrary URLs, or local file reads. This may result in the disclosure of sensitive information, such as cloud provider credentials via metadata endpoints or access to internal network services.

Recommendations Apply the Red Hat OpenShift AI update that addresses this issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-15143

Affected Products

Openshift Ai

Guardrails-Detectors

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-15143 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-15143 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2498165 · Note
• https://twitter.com/UpwindMDR/status/2075623169986085116 · Twitter Post
• https://twitter.com/CVEnew/status/2075613573703762263 · Twitter Post