CVE-2026-15143: Guardrails-Detectors SSRF Vulnerability

CVE-2026-15143 Overview

CVE-2026-15143 is a Server-Side Request Forgery (SSRF) vulnerability in the file_type content detector of guardrails-detectors. The component processes attacker-supplied XML Schema Definition (XSD) strings without proper restrictions. A remote, unauthenticated attacker can force the server to issue arbitrary outbound requests or read local files. Successful exploitation leads to disclosure of sensitive data such as cloud provider credentials or access to internal network services. The flaw is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can trigger arbitrary server-side HTTP requests and local file reads, exposing internal services and cloud metadata credentials.

Affected Products

guardrails-detectors (file_type content detector component)
Red Hat distributions that package guardrails-detectors (see Red Hat CVE-2026-15143 Advisory)
Downstream AI guardrail deployments embedding the affected detector

Discovery Timeline

2026-07-10 - CVE-2026-15143 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15143

Vulnerability Analysis

The file_type content detector in guardrails-detectors accepts an XSD string as input and parses it without disabling external entity resolution or restricting schema location URIs. XSD parsing supports schemaLocation, include, and import directives that instruct the parser to fetch remote resources. When the parser processes attacker-controlled XSD content, it dereferences these URIs from the server context. The scope change reflected in the CVSS vector indicates that the impact crosses the trust boundary of the vulnerable component.

Root Cause

The root cause is missing validation and sandboxing of untrusted XSD input passed to the XML parser. The parser resolves external references using the server's network stack and file system permissions. No allowlist restricts destination hosts, protocols, or file schemes. This is a classic SSRF pattern arising from unsafe XML processing, closely related to XML External Entity (XXE) handling weaknesses.

Attack Vector

An unauthenticated attacker submits a crafted XSD payload to any API endpoint routing input through the file_type detector. The malicious schema references URIs such as http://169.254.169.254/latest/meta-data/ to retrieve cloud instance metadata, http://internal-service.local/ to probe internal services, or file:///etc/passwd to read local files. The parser fetches the referenced content, and response data or timing side channels leak information back to the attacker. Because processing occurs before authentication in some deployment patterns, exploitation requires only network reachability.

See the Red Hat Bug #2498165 for the upstream technical discussion.

Detection Methods for CVE-2026-15143

Indicators of Compromise

Outbound HTTP or HTTPS requests from guardrails-detectors processes to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Unexpected DNS resolutions for internal hostnames originating from the detector service account.
Application logs containing XSD payloads with schemaLocation, xs:import, or xs:include referencing external URIs.
File read events on sensitive paths (/etc/passwd, /proc/self/environ, cloud credential files) by the detector process.

Detection Strategies

Inspect ingress payloads sent to guardrail APIs for XML content containing external schema references.
Correlate detector process telemetry with outbound network flows to non-allowlisted destinations.
Alert on any access by the detector service to link-local metadata addresses (169.254.0.0/16).
Baseline normal HTTP egress from AI service pods and flag deviations, especially requests to RFC 1918 ranges or file:// handler activity.

Monitoring Recommendations

Enable egress logging on the Kubernetes namespace or host running guardrails-detectors and stream logs to a centralized data lake.
Monitor XML parser error logs for schema resolution failures indicating exploitation attempts.
Track authentication events on cloud metadata services and cross-reference with detector activity windows.

How to Mitigate CVE-2026-15143

Immediate Actions Required

Apply the vendor patch referenced in the Red Hat CVE-2026-15143 Advisory as soon as it is available for your distribution.
Block egress from guardrails-detectors pods and hosts to cloud metadata endpoints and internal management networks using network policies or firewall rules.
Rotate any credentials that were accessible from the affected host's IAM role or instance profile.
Restrict input to the file_type detector at the API gateway to reject XML content containing external references until patched.

Patch Information

Red Hat has published tracking for this vulnerability under CVE-2026-15143. Consult the advisory for fixed package versions and errata identifiers. Upstream fixes should disable resolution of external schema locations, disallow file:// URIs, and enforce a strict allowlist for any legitimate remote schema retrieval.

Workarounds

Configure the XML parser used by the detector to disable external entity and schema resolution (equivalent to FEATURE_SECURE_PROCESSING and disabling http, file, and jar protocols).
Deploy the service behind a strict egress proxy that denies requests to link-local, loopback, and private IP ranges.
Enforce IMDSv2 with hop-limit 1 on AWS instances to blunt metadata credential theft via SSRF.
Run the detector under a service account with minimal filesystem read permissions and no access to secret mounts.

bash

# Example Kubernetes NetworkPolicy blocking egress to cloud metadata
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: guardrails-detectors-egress
  namespace: ai-guardrails
spec:
  podSelector:
    matchLabels:
      app: guardrails-detectors
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.0.0/16
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16