External risk intelligence

Guardrails AI Malicious Package Ingestion

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-45758

This vulnerability is a supply-chain issue involving a malicious package (dependency confusion/typosquatting) distributed via a package manager. It is a build-time or development-time risk affecting developer environments, not a network-reachable service, web application, or public-facing infrastructure.

Guardrailsai Guardrails Ai

0.10.1

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A malicious version of a Python AI development tool was briefly available, posing a risk to users who installed it. While the issue was quickly contained, it highlights the importance of supply chain security in software development. The main concern is confirming relevance and exposure to affected systems and credentials.

Malicious AI tool code was briefly published.
Confirms the need for supply chain vigilance.
Assess exposure and protect developer credentials.

Attack Path

How an attacker could exploit the issue

An attacker could trick users into installing a malicious version of the `guardrails-ai` Python package from PyPI. If a user installs this compromised package, it could lead to their system being compromised, potentially allowing an attacker to access sensitive credentials and perform unauthorized actions.

Requires installation of a malicious package.
Triggered by importing the compromised library.
Risk of credential theft and system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, users who installed a malicious version of the Guardrails AI Python framework could face risks to system and user data. The malicious package was published to PyPI and quarantined shortly after. There is no evidence of exfiltration of user data through Guardrails AI infrastructure, but affected users should take precautions with their credentials and system security.

System credentials and tokens may be compromised.
Malicious code could execute during installation or use.
Unauthorized access to cloud or code repositories.

Operational Fix

Recommended remediation, mitigation, and detection steps

The immediate concern is for any team that manages development environments where developers might have installed the malicious version of the Guardrails AI framework. The first practical step is to identify all machines that installed the affected version and confirm if any sensitive credentials were exposed. Following that, a targeted remediation plan should be executed, prioritizing systems with the highest risk of credential compromise or subsequent exploitation.

Application owners and platform teams own remediation.
Verify credential rotation and audit GitHub activity.
Upgrade to unaffected versions or downgrade immediately.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Guardrails AI?

Guardrails AI is a Python framework designed to help developers build and manage AI applications. It provides tools to implement validation and structure for AI model outputs, helping ensure the reliability and safety of interactions within AI-powered software systems.

What does CWE-506 mean for CVE-2026-45758?

CWE-506 refers to 'Embedded Malicious Code.' In the context of CVE-2026-45758, this means a malicious actor successfully injected unauthorized, harmful functionality into a legitimate-looking package. Instead of standard AI validation code, the compromised version included hidden commands designed to execute on the user's system upon installation.

How does the malicious code in the package trigger?

The malicious behavior triggers simply by installing and importing the compromised version of the package. It does not require a specific web request or public network exposure to activate. If you did not install version 0.10.1 specifically on May 11, 2026, or if you use other versions, your system is not affected by this specific malicious code.

Is my infrastructure at risk, according to Halo Surface Signal?

Halo Surface Signal indicates a 'Very unlikely' risk to your public-facing infrastructure. This is a supply-chain issue localized to developer machines or build environments where the package was installed. It is not a vulnerability in a web-accessible service that an attacker could reach directly over the internet.

Do I need to rotate credentials if I installed the bad version?

Yes. If you installed version 0.10.1, you must assume any sensitive data on that machine—such as GitHub tokens, cloud provider keys, or API registry credentials—could be compromised. Rotate all such credentials immediately and audit your account activity for unauthorized changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.