This vulnerability exists in the file_type content detector component of guardrails-detectors within Red Hat OpenShift AI (RHOAI). An attacker can remotely provide a crafted XML Schema Definition (XSD) string that is processed without adequate validation or restriction. This improper handling can trigger server-side requests to arbitrary external or internal URLs or allow reading of local files. The flaw can result in disclosure of sensitive information such as cloud provider credentials or internal network data. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high confidentiality impact. The vendor advisory does not currently specify affected versions or remediation status.

Exploitation of this vulnerability can lead to unauthorized server-side requests to arbitrary URLs or local file reads, potentially exposing sensitive information such as cloud provider credentials and internal network services. The confidentiality impact is high, while integrity impact is low and availability impact is none. This can compromise the confidentiality of critical infrastructure and credentials within affected deployments of Red Hat OpenShift AI.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15143 for current remediation guidance. Until an official fix is available, restrict exposure of the vulnerable component to untrusted inputs and monitor for unusual server-side request activity. Follow vendor updates closely for patches or workarounds.