QG022 Rail with a published advisory¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Vulnerability |
| Severity | the advisory's |
| Front end | a Colang 1 or Colang 2 policy, by its text, and a config.yml, by the library rails it names |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): which rails a configuration runs, at which versions, is a governance decision and a map of what runs; the finding measures nothing a person has not already reproduced |
| OWASP | LLM04:2026 Supply Chain, ASI04:2026 Agentic Supply Chain Vulnerabilities |
| Gates by default | yes |
Raised when¶
A scanned flow matches an advisory in the hunter's registry, by its normalised text or by the library rail a configuration names.
Why it matters¶
The flow is one a published advisory describes: a defect found in a rail and reproduced, travelling with every copy of the file and every configuration that names the library's rail. The hunter knows the advisories its registry holds at the version named in the scan's metadata.
How to fix it¶
Upgrade to the advisory's fixed version where there is one; otherwise apply the advisory's fix to the flow, or stop naming the library rail. Supply --dependencies so a reference is checked against the version you install.
OWASP LLM04:2026 and ASI04:2026, pin and verify what you run: pin each rail, tool, server and action module to a version or a digest.
OWASP entries¶
LLM04:2026 Supply Chain and ASI04 Agentic Supply Chain Vulnerabilities, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because a rail with a published defect is a third-party artefact the agent runs. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
The advisory's id as advisory, its severity, summary and fix; for a match by reference without --dependencies, version: unknown with the affected range and the fixed version. A fingerprint over the rule, the advisory and the flow's location, so the finding closes when the flow changes or the installed version leaves the range. There is no witness: the defect is the advisory's, reproduced when it was published. Every scan's metadata and SARIF run carry advisories_digest and advisories_version. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.