CVE-2026-15154: Red Hat OpenShift AI ReDoS Vulnerability

CVE-2026-15154 Overview

CVE-2026-15154 is a Regular Expression Denial of Service (ReDoS) vulnerability in guardrails-detectors, a component of Red Hat OpenShift AI. The flaw allows a remote attacker on an adjacent network to submit specially crafted regular expressions to the public detection API. Processing these expressions triggers catastrophic backtracking in the regex engine. A single request can pin a worker process at 100% CPU indefinitely, breaking the guardrails-mediated large language model (LLM) pipeline. The weakness is classified as [CWE-1333] Inefficient Regular Expression Complexity.

Critical Impact
An unauthenticated attacker can exhaust CPU resources on guardrails-detectors workers, producing a sustained denial of service across the entire guardrails-mediated LLM pipeline in Red Hat OpenShift AI.

Affected Products

Red Hat OpenShift AI
guardrails-detectors component
LLM pipelines mediated by OpenShift AI guardrails

Discovery Timeline

2026-07-08 - CVE-2026-15154 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15154

Vulnerability Analysis

The guardrails-detectors service exposes a public detection API that accepts user-supplied regular expressions. The regex engine evaluates these patterns against detector inputs without complexity limits or execution timeouts. Adversarial patterns with nested quantifiers or overlapping alternations cause the engine to explore an exponential number of backtracking paths. A single worker thread then consumes 100% CPU for an unbounded duration.

Because worker capacity is shared across the guardrails pipeline, saturating one or more workers stalls detection for all downstream LLM traffic. Requests that depend on guardrail evaluation queue indefinitely or fail, disrupting inference services built on Red Hat OpenShift AI.

The attack requires network adjacency but no authentication and no user interaction. Confidentiality and integrity are not affected; availability impact is high.

Root Cause

The root cause is inefficient regular expression complexity in the detection API handler. User-controlled patterns are compiled and executed by a backtracking regex engine without input validation, pattern safety analysis, or CPU-time limits. Catastrophic backtracking arises when a crafted pattern is applied to a matching input string, converting a single API call into an open-ended computation.

Attack Vector

An attacker with access to the adjacent network reachable by the guardrails-detectors API sends a POST request containing a malicious regular expression, such as a pattern using nested quantifiers against a long input. The worker process begins evaluation and enters catastrophic backtracking. Repeating the request against multiple workers exhausts the detection tier and denies service to legitimate LLM pipeline traffic.

No verified proof-of-concept code is published. See the Red Hat CVE-2026-15154 Advisory and Red Hat Bug Report #2498188 for vendor technical detail.

Detection Methods for CVE-2026-15154

Indicators of Compromise

Sustained 100% CPU utilization on one or more guardrails-detectors worker processes with no corresponding increase in legitimate request volume.
API requests to the public detection endpoint containing regex patterns with nested quantifiers, unbounded repetition, or overlapping alternations.
Growing request queue depth and rising latency across the guardrails-mediated LLM pipeline.

Detection Strategies

Log all inbound regex payloads submitted to the guardrails-detectors detection API and flag patterns matching known ReDoS heuristics.
Correlate per-request execution time with source IP to identify clients issuing long-running regex evaluations.
Alert when worker CPU time per request exceeds a defined threshold, for example 500 ms sustained.

Monitoring Recommendations

Track CPU saturation, request duration percentiles, and worker restart counts for guardrails-detectors pods in OpenShift.
Monitor OpenShift AI pipeline health metrics for guardrail evaluation timeouts and failed inference calls.
Forward API access logs and pod metrics to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-15154

Immediate Actions Required

Apply the fixed guardrails-detectors build as published in the Red Hat CVE-2026-15154 Advisory once available for your OpenShift AI channel.
Restrict network access to the detection API to trusted clients using OpenShift NetworkPolicy and service mesh authorization.
Enforce per-request CPU-time and wall-clock timeouts on the detection API to bound worker execution.

Patch Information

Refer to the Red Hat CVE-2026-15154 Advisory and the associated Red Hat Bug Report #2498188 for the authoritative list of fixed component versions, errata identifiers, and applicable Red Hat OpenShift AI channels.

Workarounds

Place a reverse proxy or API gateway in front of guardrails-detectors and enforce request size limits, rate limiting, and regex payload inspection.
Reject or sanitize client-supplied regular expressions containing constructs commonly associated with catastrophic backtracking such as (a+)+ or (.*)*.
Run detection workers under strict resource quotas so that a saturated worker is terminated and restarted rather than blocking indefinitely.

bash

# Example OpenShift NetworkPolicy restricting access to guardrails-detectors
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-guardrails-detectors
  namespace: redhat-ods-applications
spec:
  podSelector:
    matchLabels:
      app: guardrails-detectors
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: trusted-llm-clients
      ports:
        - protocol: TCP
          port: 8080