Executive brief
A security vulnerability exists in the file type detection component of Red Hat OpenShift AI and the guardrails-detectors library. This component is used to validate and identify different file formats within AI workflows. An attacker can exploit this flaw to force the system to make unauthorized network requests or read sensitive local files, potentially leading to the theft of cloud credentials or access to private internal services.
Technical details
A Server-Side Request Forgery (SSRF) and local file read vulnerability was identified in the file_type content detector of guardrails-detectors. The root cause is the `is_valid_xml_schema` function in `detectors/built_in/file_type_detectors.py`, which passes user-supplied XML Schema Definition (XSD) strings directly to `xmlschema.XMLSchema()` without sanitization or restriction. Because the `xmlschema` library (pinned to version 4.1.0) is not configured with `allow='sandbox'` or `allow='local'`, it resolves external references such as `<xs:import>` or `<xs:include>` using any URL scheme, including `http://` and `file://`. A remote, unauthenticated attacker can use this to perform blind SSRF against internal metadata services (e.g., AWS/GCP metadata endpoints) or read local system files like Kubernetes service account tokens. While the application catches exceptions and may not return the file content directly to the user, the server-side request or file access is still executed.
Affected products
- Red Hat Red Hat OpenShift AI (RHOAI) unspecified
- TrustyAI guardrails-detectors main branch commit 747a4d3 and earlier
Timeline
- 2026-07-08: disclosed: Reported via Red Hat Product Security internal audit
- 2026-07-10: advisory: NVD and Red Hat published advisory details