CVE-2026-15378 is a critical SSRF vulnerability in the guardrails-detectors component. It allows remote attackers to submit a crafted XSD string that triggers blind SSRF, enabling unauthorized access to sensitive internal endpoints and local files containing critical credentials and secrets. The vulnerability affects Red Hat OpenShift AI products, as indicated by Red Hat security advisories. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, limited integrity impact, and no availability impact. Red Hat has released updated container images for Red Hat OpenShift AI to address this issue, though no explicit patch details are provided in the advisories.

Successful exploitation allows remote attackers to perform blind SSRF, potentially accessing sensitive information such as cloud metadata credentials, Kubernetes API data, internal MinIO storage, and local files containing service account tokens and pod secrets. This can lead to significant confidentiality breaches within affected environments. The vulnerability does not impact system availability and has limited integrity impact.

Red Hat has issued security advisories recommending upgrading to updated Red Hat OpenShift AI container images that include mitigations for this vulnerability. Users should follow the official Red Hat OpenShift AI upgrade documentation to apply these updates fully. No additional vendor-provided patches are explicitly stated beyond updated images. Patch status is confirmed by the vendor advisory indicating updated images are available. Users should prioritize applying these updates to mitigate the risk.