CVE-2026-45758: Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Synopsis

This is a supply chain compromise affecting guardrails-ai version 0.10.1, a Python framework for building AI applications. An attacker published a malicious package to PyPI on May 11, 2026; any container image that installed guardrails-ai==0.10.1 during that window may carry the backdoor. The malicious code runs in the context of the installing environment and, if triggered, gives the attacker full read access to secrets, the ability to modify files and environment state, and the ability to disrupt running processes. No fix version has been published by the upstream maintainers; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a clean release is confirmed.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The malicious payload communicates outbound over the network; the compromised environment must have egress connectivity for the attacker to receive exfiltrated data or issue commands.

• AuthenticationNot required

  No authentication is required; any process that imports the compromised package triggers the malicious code without needing credentials.

• Victim interactionRequired

  A developer or automated pipeline must actively install or import guardrails-ai==0.10.1, making the install or build step the social-engineering or CI/CD pipeline vector.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable once the malicious package is present; no race condition or special memory layout is needed.

Blast Radius

• Reads secrets accessible from the build or runtime environment, including GitHub personal access tokens, cloud provider credential files, package registry tokens, and API keys stored in environment variables or config files.
• Modifies the environment by potentially writing unauthorized GitHub Actions workflows or creating rogue repositories under the victim's GitHub account.
• Exfiltrates captured credentials to attacker-controlled infrastructure over outbound network connections.
• Disrupts downstream CI/CD pipelines and deployed services if rotated credentials are embedded in running workloads before the compromise is discovered.