CVE-2026-15378 -- CVSS 9.3 Vulnerability Briefing

CVE-2026-15378 | CVSS 9.3 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-15378 is a blind Server-Side Request Forgery (SSRF) vulnerability in the guardrails-detectors component, exploitable by a remote, unauthenticated attacker via a maliciously crafted XML Schema submission.

Technical Detail

The flaw exists in the XML Schema parsing logic within guardrails-detectors, where user-supplied schema input is processed without adequate validation or restriction of outbound network requests. An attacker can craft a schema document that causes the server to issue arbitrary HTTP or network requests to internal or external destinations, without receiving direct response content in return (blind SSRF). The primary impact is internal network reconnaissance, potential access to cloud metadata endpoints (such as AWS IMDSv1), and possible interaction with internal services not otherwise exposed to external parties, which can serve as a pivot point for further compromise.

Exploitation Status

No known exploit code is publicly available at this time, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning there is no confirmed proof-of-concept or weaponized tooling in circulation as of July 17, 2026.

Who Is Targeting This

No confirmed threat actor attribution exists for this vulnerability. Reported (research-inferred): No named groups, organizations, or individuals have been publicly linked to exploitation or targeting of this CVE in any KEV, CERT, or vendor advisory as of this writing. Attribution remains unestablished.

What To Do

Organizations using the guardrails-detectors component should apply any available patches or updated releases from the maintainer immediately, given the critical CVSS score of 9.3. Where patching cannot be applied immediately, restrict the network egress of any host running this component using firewall rules or security group policies to block unexpected outbound connections, particularly to internal RFC 1918 address ranges and cloud metadata endpoints (e.g., 169.254.169.254). Disable or sandbox XML Schema processing functionality if it is not operationally required. Monitor outbound HTTP request logs from affected services for anomalous destinations or patterns consistent with SSRF probing. Confirm with your vendor or the upstream project whether a fixed version is available and track the advisory for updated guidance.