OpenShift AI guardrails-detectors: unauthenticated blind SSRF and file read via crafted XSD

Impact

A crafted XML Schema Definition string submitted to the guardrails-detectors component drives a blind server-side request from inside the cluster, and Red Hat names the targets explicitly: cloud metadata services, the Kubernetes API, internal MinIO, and other internal endpoints. The same flaw also reads local files, which on a pod means the mounted ServiceAccount token and pod secrets. That turns a guardrails endpoint - typically one of the more exposed pieces of an inference stack - into a route to cluster credentials and to the object storage holding model weights and datasets. Confidentiality is the main loss here; the CVSS vector rates integrity low and availability none.

Who can reach it

Anyone able to reach the guardrails-detectors endpoint and submit a schema string. The CVSS vector records no privileges required, so treat it as unauthenticated from wherever that endpoint is exposed.

What to do

Apply RHSA-2026:60520 for Red Hat OpenShift AI 3.4 and let the operator redeploy the detector pods - a rolling restart of the affected deployment, no node maintenance. Until then, keep the detector endpoint off any network path reachable by untrusted callers, and rotate ServiceAccount tokens and MinIO credentials the pod could have read if you believe it was exposed.

References

Related entries

• Jupyter Server: notebook HTML rendered without CSP sandbox gives stored XSS and kernel RCECVE-2026-44727 · Jupyter Server nbconvert HTTP handlers (Content-Security-Policy sandbox directive)Critical
• OpenMed: unauthenticated model_name routes to a trust_remote_code loader and executes attacker codeCVE-2026-47117 · OpenMed privacy-filter model loader (model_name dispatcher, trust_remote_code=True path)Critical
• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• sentence-transformers: local model directory executes Python despite trust_remote_code=FalseCVE-2026-68770 · sentence-transformers (import_module_class trust_remote_code gate)Critical
• Langchain-Chatchat: unauthenticated /tools/call invokes the shell tool for remote command executionCVE-2026-75128 · Langchain-Chatchat (POST /tools/call API endpoint)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical