Database/AI/ML frameworks & serving
OpenShift AI guardrails-detectors: unauthenticated blind SSRF and file read via crafted XSD
Impact
A crafted XML Schema Definition string submitted to the guardrails-detectors component drives a blind server-side request from inside the cluster, and Red Hat names the targets explicitly: cloud metadata services, the Kubernetes API, internal MinIO, and other internal endpoints. The same flaw also reads local files, which on a pod means the mounted ServiceAccount token and pod secrets. That turns a guardrails endpoint - typically one of the more exposed pieces of an inference stack - into a route to cluster credentials and to the object storage holding model weights and datasets. Confidentiality is the main loss here; the CVSS vector rates integrity low and availability none.
Who can reach it
Anyone able to reach the guardrails-detectors endpoint and submit a schema string. The CVSS vector records no privileges required, so treat it as unauthenticated from wherever that endpoint is exposed.
What to do
Apply RHSA-2026:60520 for Red Hat OpenShift AI 3.4 and let the operator redeploy the detector pods - a rolling restart of the affected deployment, no node maintenance. Until then, keep the detector endpoint off any network path reachable by untrusted callers, and rotate ServiceAccount tokens and MinIO credentials the pod could have read if you believe it was exposed.
References
Related entries
- MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
- LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
- Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
- llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
- Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
- Qdrant (snapshot recovery): Arbitrary file read and write during snapshot recoveryCVE-2024-3829 · Qdrant (snapshot recovery)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.