guardrails-detectors XSD Blind SSRF and Local File Read Vulnerability
First seen Jul 12, 2026 · Updated Jul 12, 2026 · CVSS 9.3
A critical SSRF vulnerability in the guardrails-detectors component allows remote attackers to submit malicious XSD schemas that trigger out-of-band requests to internal services. Exploitation can expose cloud metadata credentials, Kubernetes API tokens, MinIO endpoints, and local files such as service account tokens, enabling further lateral movement and privilege escalation.
Technical Analysis
The vulnerability stems from unsafe XML Schema Definition (XSD) parsing within guardrails-detectors, which processes external entity or schema references without adequate validation, enabling classic XXE-style SSRF behavior. An attacker can craft an XSD payload referencing internal-only URLs (e.g., 169.254.169.254 for cloud metadata, kubernetes.default.svc for the K8s API, or internal MinIO hosts) to exfiltrate secrets via blind, out-of-band responses. The flaw also permits local file inclusion, allowing retrieval of Kubernetes service account tokens and mounted pod secrets, which can be leveraged for container escape or cluster-wide compromise. Because guardrails-detectors is commonly deployed as a safety/validation layer in LLM and AI agent pipelines, this vulnerability directly threatens agent systems: an attacker who compromises the guardrails layer can steal API keys, cloud credentials, and service tokens used by agents, potentially pivoting to control RAG data stores, model endpoints, or downstream agent tool integrations.
Affected Systems
guardrails-detectors component (all versions prior to patched release) deployed in LLM guardrail/validation pipelines, particularly in Kubernetes-hosted AI agent and RAG infrastructure with MinIO or cloud metadata service access
Indicators of Compromise
- Outbound requests to 169.254.169.254
- DNS/HTTP requests to kubernetes.default.svc
- Unexpected connections to internal MinIO endpoints
- Anomalous XSD/XML payloads containing external schema references
- Unusual file read attempts on /var/run/secrets/kubernetes.io/serviceaccount/token
Remediation Steps
- 1
Patch guardrails-detectors
Upgrade to the vendor-released fixed version that disables external entity resolution and restricts XSD schema fetching to trusted, allow-listed sources.
- 2
Restrict outbound network access
Apply network policies to block pod egress to cloud metadata IPs (169.254.169.254), the Kubernetes API server, and internal services unless explicitly required.
- 3
Harden XML parsing
Disable external DTD/schema resolution in all XML/XSD parsing libraries used by guardrails or agent validation components.
- 4
Rotate exposed credentials
Rotate cloud metadata credentials, Kubernetes service account tokens, and MinIO access keys potentially exposed prior to patching.
- 5
Enforce least privilege for service accounts
Limit Kubernetes service account permissions attached to guardrails pods to minimize blast radius if tokens are stolen.
- 6
Monitor and alert on SSRF indicators
Deploy egress monitoring and WAF rules to detect and block malicious XSD payloads and anomalous internal service calls.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.