Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-15143

CVE-2026-15143CRITICAL

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  L  N    9.3   .0043   36.1     —

AFFECTED
  Product                   Versions     Fixed
  guardrails-detectors      unspecified  —
  Red Hat OpenShift AI 3.4  unspecified  1791537794
  Red Hat OpenShift AI 3.4  unspecified  1791535841

TIMELINE
  Jul 8   Reserved by redhat
  Jul 10  Published (CNA: redhat)
  Oct 18  PATCH SHIPPED — CVE-2026-15143 (guardrails-detectors). Fixed in Red Hat OpenShift AI 3.4 1791537794.

CWE-918 · CNA: redhat · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis

Description

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 8, 2026	Reserved	Reserved by redhat
July 10, 2026	Published	Published (CNA: redhat)
October 18, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-15143 (guardrails-detectors). Fixed in Red Hat OpenShift AI 3.4 1791537794.

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
—	guardrails-detectors	—	—	—
Red Hat	Red Hat OpenShift AI 3.4	—	—	1791537794
Red Hat	Red Hat OpenShift AI 3.4	—	—	1791535841

Weaknesses

CWE-918

References (3)

https://access.redhat.com/errata/RHSA-2026:84734 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-15143 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2498165 [issue-tracking, x_refsource_REDHAT]

Authoritative record: CVE-2026-15143 at cve.org

Vendors: red hat

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-15143 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.