Read the docs
TI-2026-32428 Aliases CVE-2026-44494GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Priority HIGH 73CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 48 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01057 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.16.0axios (npm): 1.16.0Red Hat: 55 advisoriesRed Hat: 48 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.0.0 to before 1.16.01.16.0Patch availableCNA
—axios (npm)1.0.0 to before 1.16.01.16.0Patch availableGHSA-35jp-ww65-95wh
  • axios Vendoraxios Affected 1.0.0 to before 1.16.0 Fixed in 1.16.0 Patch available CNA
  • axios (npm) Vendor— Affected 1.0.0 to before 1.16.0 Fixed in 1.16.0 Patch available GHSA-35jp-ww65-95wh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*1.0.0 to before 1.16.0Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 1.16.0 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.16.0
  • Fix · GHSA-35jp-ww65-95wh axios (npm) Fixed in 1.16.0 Advisory →

Red Hat 55 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
Show 52 more Red Hat advisories
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:54188 Released 2026-08-20 · Red Hat rating Important
    OpenShift Container Platform 4.13.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:43052 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40795 Released 2026-07-21 · Red Hat rating Important
    OpenShift Container Platform 4.20.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2026:40792 Released 2026-07-21 · Red Hat rating Important
    OpenShift Container Platform 4.21.25 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
  • RHSA-2026:42146 Released 2026-07-20 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42142 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
  • RHSA-2026:42078 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
  • RHSA-2026:42085 Released 2026-07-20 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-ui-rhel9
  • RHSA-2026:41951 Released 2026-07-20 · Red Hat rating Important
    Red Hat Data Grid 8.6.2 security update
    • Red Hat Data Grid 8.6.2
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
  • RHSA-2026:41055 Released 2026-07-16 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.12 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:36611 Released 2026-07-16 · Red Hat rating Important
    OpenShift Container Platform 4.14.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8, registry.redhat.io/openshift4/ose-prometheus +1
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:36883 Released 2026-07-08 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.5 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:36820 Released 2026-07-08 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.0 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
  • RHSA-2026:36754 Released 2026-07-08 · Red Hat rating Important
    Red Hat Developer Hub 1.10.2 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:34794 Released 2026-07-07 · Red Hat rating Important
    OpenShift Container Platform 4.22.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:36108 Released 2026-07-07 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:29864 Released 2026-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.19.36 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:28964 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.15.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:34530 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:34527 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:34525 Released 2026-07-01 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:29082 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.16.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator +8
  • RHSA-2026:33574 Released 2026-06-30 · Red Hat rating Important
    Red Hat Developer Hub 1.9.6 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:29800 Released 2026-06-30 · Red Hat rating Important
    OpenShift Container Platform 4.20.27 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:33183 Released 2026-06-29 · Red Hat rating Important
    Kiali 2.22.6 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:33173 Released 2026-06-29 · Red Hat rating Important
    Kiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:33163 Released 2026-06-29 · Red Hat rating Important
    Kiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:33160 Released 2026-06-29 · Red Hat rating Important
    Kiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:33155 Released 2026-06-29 · Red Hat rating Important
    Kiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
  • RHSA-2026:33005 Released 2026-06-29 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:30651 Released 2026-06-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
  • RHSA-2026:30650 Released 2026-06-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.8 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
  • RHSA-2026:29197 Released 2026-06-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:27044 Released 2026-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.21.21 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-haproxy-router-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:22465 Released 2026-06-02 · Red Hat rating Important
    Red Hat Quay 3.17.2
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:20938 Released 2026-05-26 · Red Hat rating Important
    RHACS 4.9.7 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:20889 Released 2026-05-26 · Red Hat rating Important
    RHACS 4.10.3 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman Desktop - Tech PreviewAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:30651
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:20938
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:20889
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:42142
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:36108
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:33005
Red Hat Data Grid 8.6.2Fixed RHSA-2026:41951
Red Hat Developer Hub 1.10Fixed RHSA-2026:36754
Red Hat Developer Hub 1.9Fixed RHSA-2026:33574
Red Hat Discovery 2Fixed RHSA-2026:29197
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:54188
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:36611
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:28964
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:29082
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:29864
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:29800, RHSA-2026:40795
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:27044, RHSA-2026:40792
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:34794
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:36820
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:33155
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:33160
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:33163
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:33173
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:33183
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.12Fixed RHSA-2026:42146, RHSA-2026:43052
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:22465
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Satellite 6.19Fixed RHSA-2026:34525, RHSA-2026:34527, RHSA-2026:34530
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:42085
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:46885
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:41055
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:30650
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:36883
Not affected: 51 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Applications 8
  • Network Observability Operator
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 3
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44494
  2. 2026-10-03 Alias added: GHSA-35jp-ww65-95wh
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Exploit 1

Advisory 2

Other 1

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
  • TI-2026-32424 Axios: Allocation of Resources Without Limits or Throttling in axios CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences