Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- Partial Red Hat: 49 fixed, 14 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00854 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.15.2, 0.31.1axios (npm): 1.15.2, 0.31.1Red Hat: 54 advisoriesRed Hat: 49 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| axios | axios | 1.0.0 to before 1.15.2; 0.19.0 to before 0.31.1 | 1.15.2, 0.31.1 | Patch available | CNA |
| — | axios (npm) | 1.0.0 to before 1.15.2 | 1.15.2 | Patch available | GHSA-3g43-6gmg-66jw |
| — | axios (npm) | 0.19.0 to before 0.31.1 | 0.31.1 | Patch available | GHSA-3g43-6gmg-66jw |
- axios Vendoraxios Affected 1.0.0 to before 1.15.2; 0.19.0 to before 0.31.1 Fixed in 1.15.2, 0.31.1 Patch available CNA
- axios (npm) Vendor— Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available GHSA-3g43-6gmg-66jw
- axios (npm) Vendor— Affected 0.19.0 to before 0.31.1 Fixed in 0.31.1 Patch available GHSA-3g43-6gmg-66jw
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* | 0.19.0 to before 0.31.1; 1.0.0 to before 1.15.2 | Vulnerable | axios |
| cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:* | before 2.13.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernates:*:* | before 4.10.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_automation_platform:2.6:*:*:*:*:*:*:* | 2.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:data_grid:8.6.2:*:*:*:*:*:*:* | 8.6.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_service_mesh:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
- cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions 0.19.0 to before 0.31.1; 1.0.0 to before 1.15.2 Vulnerable ·axios
- cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:* Versions before 2.13.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernates:*:* Versions before 4.10.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_automation_platform:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:data_grid:8.6.2:*:*:*:*:*:*:* Versions 8.6.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_service_mesh:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
Remediation
- Fix · CNA axios (axios) Fixed in 1.15.2, 0.31.1
- Fix · GHSA-3g43-6gmg-66jw axios (npm) Fixed in 1.15.2 Advisory →
- Fix · GHSA-3g43-6gmg-66jw axios (npm) Fixed in 0.31.1 Advisory →
Red Hat 54 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
Show 51 more Red Hat advisories
- RHSA-2026:59833 Released 2026-09-03 · Red Hat rating ImportantOpenShift Container Platform 4.12.97 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:54188 Released 2026-08-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.70 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
- RHSA-2026:57191 Released 2026-08-19 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
- RHSA-2026:54555 Released 2026-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.19.43 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:53840 Released 2026-08-11 · Red Hat rating ImportantOpenShift Virtualization v4.15 Images
- Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2026:50300 Released 2026-08-04 · Red Hat rating ImportantMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
- RHSA-2026:47451 Released 2026-07-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
- RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:46903 Released 2026-07-27 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
- RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40768 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.22.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:40795 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.20.30 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9
- RHSA-2026:40792 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.21.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42142 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41064 Released 2026-07-16 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
- RHSA-2026:41055 Released 2026-07-16 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.12 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:36611 Released 2026-07-16 · Red Hat rating ImportantOpenShift Container Platform 4.14.69 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8, registry.redhat.io/openshift4/ose-prometheus +1
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:36883 Released 2026-07-08 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.5 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
- RHSA-2026:36882 Released 2026-07-08 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:36108 Released 2026-07-07 · Red Hat rating ImportantOpenShift Virtualization v4.13 Images
- Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2026:28964 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.15.66 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
- RHSA-2026:34374 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
- RHSA-2026:34160 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
- RHSA-2026:29082 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.16.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator +8
- RHSA-2026:33574 Released 2026-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.9.6 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:33183 Released 2026-06-29 · Red Hat rating ImportantKiali 2.22.6 for Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33173 Released 2026-06-29 · Red Hat rating ImportantKiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33163 Released 2026-06-29 · Red Hat rating ImportantKiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33160 Released 2026-06-29 · Red Hat rating ImportantKiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33155 Released 2026-06-29 · Red Hat rating ImportantKiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
- RHSA-2026:30651 Released 2026-06-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
- RHSA-2026:30650 Released 2026-06-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.8 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
- RHSA-2026:29197 Released 2026-06-24 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:27063 Released 2026-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.20.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +3
- RHSA-2026:27044 Released 2026-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.21.21 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-haproxy-router-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:27944 Released 2026-06-22 · Red Hat rating ImportantOpenShift Virtualization v4.14 Images
- Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2026:22465 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:20938 Released 2026-05-26 · Red Hat rating ImportantRHACS 4.9.7 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
- RHSA-2026:20889 Released 2026-05-26 · Red Hat rating ImportantRHACS 4.10.3 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2026:41064 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:30651 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2026:36882 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:46903 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:57191 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:20938 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:20889 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:34374 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:42142 |
| Red Hat Container Native Virtualization 4.13 | Fixed | RHSA-2026:36108 |
| Red Hat Container Native Virtualization 4.14 | Fixed | RHSA-2026:27944 |
| Red Hat Container Native Virtualization 4.15 | Fixed | RHSA-2026:53840 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:33574 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:29197 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat Migration Toolkit for Applications 8.1 | Fixed | RHSA-2026:50300 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:59833 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:54188 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:36611 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:28964 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:29082 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:54555 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:27063, RHSA-2026:40795 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:27044, RHSA-2026:40792 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:40768 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:33155 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:33160 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:33163 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:33173 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:33183 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:22465 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:46885 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:41055 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:30650 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:36883 |
Not affected: 54 products
- Cryostat 4
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Network Observability Operator
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Migration Toolkit 1.8
- Red Hat Migration Toolkit for Applications 8.1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Service Mesh 3.3
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Red Hat build of Apache Camel for Spring Boot 4
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44495
- 2026-10-03 Alias added: GHSA-3g43-6gmg-66jw
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:27944 · Red Hat
References
Advisory 47
- https://nvd.nist.gov/vuln/detail/CVE-2026-44495
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:27044
- https://access.redhat.com/errata/RHSA-2026:27063
- https://access.redhat.com/errata/RHSA-2026:27944
- https://access.redhat.com/errata/RHSA-2026:28964
- https://access.redhat.com/errata/RHSA-2026:29082
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:30650
- https://access.redhat.com/errata/RHSA-2026:30651
- https://access.redhat.com/errata/RHSA-2026:33155
- https://access.redhat.com/errata/RHSA-2026:33160
- https://access.redhat.com/errata/RHSA-2026:33163
- https://access.redhat.com/errata/RHSA-2026:33173
- https://access.redhat.com/errata/RHSA-2026:33183
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34160
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:36108
- https://access.redhat.com/errata/RHSA-2026:36611
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:36883
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40768
- https://access.redhat.com/errata/RHSA-2026:40792
- https://access.redhat.com/errata/RHSA-2026:40795
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41055
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:42142
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:46885
- https://access.redhat.com/errata/RHSA-2026:46903
- https://access.redhat.com/errata/RHSA-2026:50300
- https://access.redhat.com/errata/RHSA-2026:53840
- https://access.redhat.com/security/cve/CVE-2026-44495
- https://bugzilla.redhat.com/show_bug.cgi?id=2487937
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44495.json
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
Sources
- CVE-2026-44495 · CVE Program
- CVE-2026-44495 · NVD
- FIRST EPSS
- GHSA-3g43-6gmg-66jw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44495 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences