This vulnerability exists in the guardrails-detectors component of Red Hat OpenShift AI (RHOAI). An attacker can remotely submit specially crafted XML Schema Definition (XSD) strings that trigger blind Server-Side Request Forgery (SSRF). This flaw enables unauthorized access to sensitive information from internal network endpoints, including credentials from cloud metadata services, Kubernetes API, internal MinIO storage, and local files containing critical data like service account tokens and pod secrets. The CVSS 3.1 base score is 9.3, reflecting its critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information including cloud metadata credentials, Kubernetes API data, internal MinIO storage contents, and local files such as service account tokens and pod secrets. This compromises confidentiality and could facilitate further attacks within the affected environment. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15378 for current remediation guidance. No official fix or temporary workaround is currently documented in the provided data. Users should monitor the vendor advisory for updates and apply patches promptly once available.