An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN…
Priority HIGH 68CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 12 fixed, 12 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.
Summary
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00729 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (npm): 1.6.0, 0.28.0Red Hat: 11 advisoriesRed Hat: 12 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | axios (npm) | 1.0.0 to before 1.6.0 | 1.6.0 | Patch available | GHSA-wf5p-g6vw-rhxx |
| — | axios (npm) | 0.8.1 to before 0.28.0 | 0.28.0 | Patch available | GHSA-wf5p-g6vw-rhxx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- axios (npm) Vendor— Affected 1.0.0 to before 1.6.0 Fixed in 1.6.0 Patch available GHSA-wf5p-g6vw-rhxx
- axios (npm) Vendor— Affected 0.8.1 to before 0.28.0 Fixed in 0.28.0 Patch available GHSA-wf5p-g6vw-rhxx
Remediation
- Fix · GHSA-wf5p-g6vw-rhxx axios (npm) Fixed in 1.6.0 Advisory →
- Fix · GHSA-wf5p-g6vw-rhxx axios (npm) Fixed in 0.28.0 Advisory →
Red Hat 11 advisories
- RHSA-2025:2876 Released 2025-03-17 · Red Hat rating ModerateACS 4.7 enhancement and security update
- RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-main-rhel8 +9
- RHSA-2024:5314 Released 2024-08-13 · Red Hat rating ModerateOpenShift Virtualization 4.13.10 Images security update
- CNV 4.13 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2024:4455 Released 2024-07-10 · Red Hat rating ModerateOpenShift Virtualization 4.16.0 Images security update
- CNV 4.16 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9, container-native-virtualization/kubevirt-ssp-operator-rhel9, container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9 +1
Show 8 more Red Hat advisories
- RHSA-2024:4269 Released 2024-07-02 · Red Hat rating ModerateOpenShift Virtualization 4.12.12 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/kubevirt-console-plugin
- RHSA-2024:3989 Released 2024-06-20 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
- RHSA-2024:3920 Released 2024-06-13 · Red Hat rating ImportantMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8
- RHSA-2024:3473 Released 2024-05-29 · Red Hat rating ModerateOpenShift Virtualization 4.14.6 Images security update
- CNV 4.14 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
- RHSA-2024:3314 Released 2024-05-23 · Red Hat rating ImportantOpenShift Virtualization 4.15.2 Images security update
- CNV 4.15 for RHEL 9 container-native-virtualization/aaq-controller-rhel9, container-native-virtualization/aaq-operator-rhel9, container-native-virtualization/aaq-server-rhel9 +47
- RHSA-2024:1925 Released 2024-04-18 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.8.3 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8, rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Out of support scope |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:1925 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2024:4269 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2024:5314 |
| CNV 4.14 for RHEL 9 | Fixed | RHSA-2024:3473 |
| CNV 4.15 for RHEL 9 | Fixed | RHSA-2024:3314 |
| CNV 4.16 for RHEL 9 | Fixed | RHSA-2024:4455 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:3989 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:3920 |
| RHACS 4.7 for RHEL 8 | Fixed | RHSA-2025:2876 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1640 |
Not affected: 29 products
- 8Base-RHMTC-1.8
- CNV 4.12 for RHEL 8
- CNV 4.13 for RHEL 9
- CNV 4.14 for RHEL 9
- CNV 4.15 for RHEL 9
- CNV 4.16 for RHEL 9
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- Migration Toolkit for Applications 6
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Network Observability Operator
- OpenShift Service Mesh 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Discovery 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat OpenShift distributed tracing 2
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45857
- 2026-10-03 Alias added: GHSA-wf5p-g6vw-rhxx
- 2026-10-26 EPSS moved to the 50th–90th percentile
- 2026-10-27 Affected versions changed · Red Hat
References
Other 10
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/axios/axios/issues/6022
- https://github.com/axios/axios/pull/6028
- https://github.com/axios/axios/pull/6091
- https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967
- https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v0.28.0
- https://github.com/axios/axios/releases/tag/v1.6.0
- https://security.netapp.com/advisory/ntap-20240621-0006
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
Sources
- CVE-2023-45857 · CVE Program
- CVE-2023-45857 · NVD
- FIRST EPSS
- GHSA-wf5p-g6vw-rhxx · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45857 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences