Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-11T15:39:07
axios: Axios: Information disclosure of proxy credentials via HTTP redirects
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-201
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat Ansible Automation Platform 2.5 for RHEL 8
2026-07-20T00:00:00Z
RHSA-2026:42078
automation-gateway-0:2.5.20260715-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9
2026-07-20T00:00:00Z
RHSA-2026:42078
automation-gateway-0:2.5.20260715-1.el9ap
Red Hat Data Grid 8.6.2
2026-07-20T00:00:00Z
RHSA-2026:41951
axios
multicluster engine for Kubernetes 2.1
2026-07-27T00:00:00Z
RHSA-2026:46885
multicluster-engine/console-mce-rhel9:1784312384
multicluster engine for Kubernetes 2.1
2026-07-28T00:00:00Z
RHSA-2026:47388
multicluster-engine/console-mce-rhel9:1784312384
multicluster engine for Kubernetes 2.6
2026-07-16T00:00:00Z
RHSA-2026:41055
multicluster-engine/console-mce-rhel9:1783351002
multicluster engine for Kubernetes 2.8
2026-06-28T00:00:00Z
RHSA-2026:30650
multicluster-engine/console-mce-rhel9:1782157085
multicluster engine for Kubernetes 2.9.0
2026-07-08T00:00:00Z
RHSA-2026:36883
multicluster-engine/console-mce-rhel9:1783348181
Red Hat Advanced Cluster Management for Kubernetes 2.11
2026-07-16T00:00:00Z
RHSA-2026:41064
rhacm2/console-rhel9:1783350952
Red Hat Advanced Cluster Management for Kubernetes 2.13
2026-06-28T00:00:00Z
RHSA-2026:30651
rhacm2/console-rhel9:1782157514
Red Hat Advanced Cluster Management for Kubernetes 2.14
2026-07-08T00:00:00Z
RHSA-2026:36882
rhacm2/console-rhel9:1783451729
Red Hat Advanced Cluster Management for Kubernetes 2.15
2026-07-27T00:00:00Z
RHSA-2026:46903
rhacm2/console-rhel9:1784578812
Red Hat Advanced Cluster Management for Kubernetes 2.15
2026-07-28T00:00:00Z
RHSA-2026:47451
rhacm2/console-rhel9:1784578812
Red Hat Advanced Cluster Security 4.9
2026-05-26T00:00:00Z
RHSA-2026:20938
advanced-cluster-security/rhacs-main-rhel8:1779371594
Red Hat Advanced Cluster Security for Kubernetes 4.10
2026-05-26T00:00:00Z
RHSA-2026:20889
advanced-cluster-security/rhacs-main-rhel8:1779293013
Red Hat Ansible Automation Platform 2.7
2026-07-20T00:00:00Z
RHSA-2026:42142
ansible-automation-platform-27/gateway-rhel9:1783919486
Red Hat Developer Hub 1.10
2026-07-08T00:00:00Z
RHSA-2026:36754
rhdh/rhdh-hub-rhel9:1783448184
Red Hat Developer Hub 1.9
2026-06-30T00:00:00Z
RHSA-2026:33574
rhdh/rhdh-hub-rhel9:1782761244
Red Hat Discovery 2
2026-06-24T00:00:00Z
RHSA-2026:29197
discovery/discovery-ui-rhel9:1782166952
Red Hat Migration Toolkit 1.8
2026-07-20T00:00:00Z
RHSA-2026:41928
rhmtc/openshift-migration-ui-rhel8:1783690532
Red Hat Migration Toolkit for Applications 8.1
2026-08-04T00:00:00Z
RHSA-2026:50300
mta/mta-ui-rhel9:1785169013
Red Hat OpenShift Container Platform 4.14
2026-07-16T00:00:00Z
RHSA-2026:36611
openshift4/ose-console:1782911957
Red Hat OpenShift Container Platform 4.15
2026-07-01T00:00:00Z
RHSA-2026:28964
openshift4/ose-console:1782127091
Red Hat OpenShift Container Platform 4.16
2026-07-01T00:00:00Z
RHSA-2026:29082
openshift4/ose-console-rhel9:1782244020
Red Hat OpenShift Container Platform 4.19
2026-07-08T00:00:00Z
RHSA-2026:34766
openshift4/ose-monitoring-plugin-rhel9:1782880472
Red Hat OpenShift Container Platform 4.20
2026-06-23T00:00:00Z
RHSA-2026:27063
openshift4/ose-monitoring-plugin-rhel9:1781695012
Red Hat OpenShift Container Platform 4.21
2026-06-23T00:00:00Z
RHSA-2026:27044
openshift4/ose-monitoring-plugin-rhel9:1781731914
Red Hat OpenShift Dev Spaces 3.29
2026-07-08T00:00:00Z
RHSA-2026:36820
devspaces/code-rhel9:1782498475
Red Hat OpenShift Dev Spaces 3.29
2026-07-08T00:00:00Z
RHSA-2026:36820
devspaces/dashboard-rhel9:1782498792
Red Hat OpenShift Service Mesh 2.6
2026-06-29T00:00:00Z
RHSA-2026:33155
openshift-service-mesh/kiali-ossmc-rhel8:1781937133
Red Hat OpenShift Service Mesh 2.6
2026-06-29T00:00:00Z
RHSA-2026:33155
openshift-service-mesh/kiali-rhel8:1782287580
Red Hat OpenShift Service Mesh 3.0
2026-06-29T00:00:00Z
RHSA-2026:33160
openshift-service-mesh/kiali-ossmc-rhel9:1782201894
Red Hat OpenShift Service Mesh 3.0
2026-06-29T00:00:00Z
RHSA-2026:33160
openshift-service-mesh/kiali-rhel9:1782201833
Red Hat OpenShift Service Mesh 3.1
2026-06-29T00:00:00Z
RHSA-2026:33163
openshift-service-mesh/kiali-ossmc-rhel9:1782201696
Red Hat OpenShift Service Mesh 3.1
2026-06-29T00:00:00Z
RHSA-2026:33163
openshift-service-mesh/kiali-rhel9:1782201537
Red Hat OpenShift Service Mesh 3.2
2026-06-29T00:00:00Z
RHSA-2026:33173
openshift-service-mesh/kiali-ossmc-rhel9:1782201851
Red Hat OpenShift Service Mesh 3.2
2026-06-29T00:00:00Z
RHSA-2026:33173
openshift-service-mesh/kiali-rhel9:1782201812
Red Hat OpenShift Service Mesh 3.3
2026-06-29T00:00:00Z
RHSA-2026:33183
openshift-service-mesh/kiali-ossmc-rhel9:1782231869
Red Hat OpenShift Service Mesh 3.3
2026-06-29T00:00:00Z
RHSA-2026:33183
openshift-service-mesh/kiali-rhel9:1782201466
Red Hat Quay 3.1
2026-07-16T00:00:00Z
RHSA-2026:41031
quay/quay-rhel8:1783750447
Red Hat Quay 3.12
2026-07-20T00:00:00Z
RHSA-2026:42146
quay/quay-rhel8:1783751865
Red Hat Quay 3.12
2026-07-21T00:00:00Z
RHSA-2026:43052
quay/quay-rhel8:1784353904
Red Hat Quay 3.15
2026-07-21T00:00:00Z
RHSA-2026:42796
quay/quay-rhel8:1784351966
Red Hat Quay 3.16
2026-07-16T00:00:00Z
RHSA-2026:41066
quay/quay-rhel9:1783955846
Red Hat Quay 3.9
2026-07-15T00:00:00Z
RHSA-2026:40262
quay/quay-rhel8:1784125838
Red Hat Trusted Artifact Signer 1.3
2026-07-20T00:00:00Z
RHSA-2026:42085
rhtas/rhtas-console-ui-rhel9:1784105894
Cryostat 4
Not affected
axios
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel9
Red Hat AMQ Broker 7
Affected
axios
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Affected
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-hub
Red Hat Ansible Automation Platform 2
Affected
automation-platform-ui
Red Hat Ansible Automation Platform 2
Not affected
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Not affected
axios
Red Hat build of Apache Camel - HawtIO 4
Affected
axios
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Podman Desktop - Tech Preview
Will not fix
rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 8
Not affected
grafana-pcp
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/disk-image-cuda-rhel9
Red Hat Fuse 7
Will not fix
axios
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-dashboard-rhel8
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Virtualization 4
Affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Trusted Profile Analyzer
Affected
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Affected
ansible-automation-platform/automation-portal
Self-service automation portal 2
Affected
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-44486
https://nvd.nist.gov/vuln/detail/CVE-2026-44486
https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc