Executive brief
A vulnerability exists in the guardrails-detectors component of Red Hat OpenShift AI, which is used to validate and filter data in AI workflows. An attacker can exploit this to perform unauthorized network requests or read sensitive local files from the server. This could lead to the theft of cloud credentials, Kubernetes service tokens, and access to internal network services, potentially compromising the entire cloud environment.
Technical details
A flaw in the `file_type` detector of the `guardrails-detectors` component allows for blind Server-Side Request Forgery (SSRF) and local file disclosure. The vulnerability stems from the component accepting arbitrary XML Schema Definition (XSD) strings via the `xml-with-schema:` parameter and passing them to the `xmlschema.XMLSchema()` function without proper sandboxing. By default, this library resolves external entities and schema locations, allowing an unauthenticated remote attacker to trigger outbound requests to internal endpoints (such as cloud metadata services at 169.254.169.254) or read local files (such as Kubernetes service account tokens). The attack is blind as exfiltration occurs via side channels or error-based parsing, but the underlying requests and file access are successfully executed.
Affected products
- Red Hat Red Hat OpenShift AI (RHOAI) rhoai/odh-fms-guardrails-orchestrator-rhel9
Timeline
- 2026-07-10: disclosed: Vulnerability reported via Red Hat Bugzilla and NVD
- 2026-07-10: advisory