Red Hat Security Advisory

RHSA-2026:36611

OpenShift Container Platform 4.14.69 bug fix and security update

Released 2026-07-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8, registry.redhat.io/openshift4/ose-prometheus +1

Fixes 8 records

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3

gRPC-Go has an authorization bypass via missing leading slash in :path

MEDIUM 49

gRPC-Go is the Go language implementation of gRPC.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01619 Published 2026-03-20 Partial fix · 1.79.3 CWE-285