CVE-2026-15154: ReDoS Vulnerability in Red Hat OpenShift AI Guardrails-Detectors

Technical summary

CVE-2026-15154 is a Regular Expression Denial of Service (ReDoS) vulnerability in guardrails-detectors, a content filtering and safety component within Red Hat OpenShift AI. The flaw arises from insufficient validation of user-supplied regular expressions sent to the public detection API. Maliciously crafted patterns exploit catastrophic backtracking behavior in the regex engine, causing a single worker process to enter a compute-bound loop consuming 100% CPU. Because the detection API is typically fronting the LLM pipeline, this denial of service cascades to all users depending on that guardrail for prompt/response validation.

Business impact

Organizations running OpenShift AI with guardrails-detectors enabled may experience service interruptions when the detection pipeline stalls. If content moderation is part of your LLM deployment's user-facing SLA, this vulnerability directly impacts availability. The attack requires no authentication or special network access—any caller to the public API can trigger it. Teams operating multi-tenant AI services are particularly vulnerable to a single attacker poisoning the shared detection resource.

Affected systems

Red Hat OpenShift AI deployments utilizing the guardrails-detectors component are affected. This includes any installation where the detection API is exposed or accessible to untrusted callers. Verify the specific component version in your deployment against Red Hat's advisory to confirm exposure.

Exploitability

Exploitability is straightforward from a technical perspective: the attack requires only network access to the detection API endpoint and knowledge of regex patterns that trigger backtracking. No authentication is required, and the vector indicates attachment-level access (likely API calls from the network). The barrier to weaponization is low—regex denial of service patterns are well-documented in security literature. However, successful exploitation depends on the API being exposed or accepting user input; air-gapped or tightly controlled deployments may have reduced risk.

Remediation

Patch the guardrails-detectors component to a version that implements timeout mechanisms, regex complexity validation, or uses a safer regex engine. Consult Red Hat's security advisory for the specific patched version and deployment steps. As an interim mitigation, restrict network access to the detection API to trusted sources, implement request timeouts at the API gateway or load balancer level, and monitor worker process CPU utilization for anomalies.

Patch guidance

Apply updates from Red Hat OpenShift AI when available. Verify the patched version against the official Red Hat security advisory to ensure you receive the correct fix. Test the patch in a non-production environment before deployment to confirm compatibility with your LLM pipeline and guardrail configuration. Monitor deployment logs for any behavioral changes post-patch.

Detection guidance

Monitor worker process CPU usage for sustained spikes or 100% utilization that correlate with API calls to the detection endpoint. Implement request logging on the detection API to identify patterns of unusual regex submissions or repeated failed requests. Set alerts on worker process restarts or timeouts within the guardrails pipeline. Threat hunters can examine API logs for regex patterns containing nested quantifiers, alternations, or other known backtracking triggers.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), the practical impact on AI service availability is significant. The attack is trivial to execute, requires no privileges, and directly affects production LLM pipelines. Organizations with public-facing or multi-tenant AI services should prioritize this patch to prevent service disruption. The lack of KEV status does not diminish urgency; the vulnerability is publicly documented and easily weaponized.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-adjacent attack vector (AV:A), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and high availability impact (A:H). The score does not account for the practical ease of exploitation or the cascading nature of the denial of service in a multi-tenant environment. Organizations with SLA commitments should treat this as higher-priority than the base score suggests.

Frequently asked questions