Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-01T12:22:16 axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-915

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.

Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48758 jaeger-main-2.20.0-0.8.hum1 Red Hat Hardened Images 2026-08-03T00:00:00Z RHSA-2026:49714 grafana13-1-main-13.1.1-0.5.hum1 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50826 grafana13-1-main-13.1.1-0.5.2.hum1 Migration Toolkit for Applications 8 Affected mta/mta-ui-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/console-mce-rhel9 Network Observability Operator Affected network-observability/network-observability-console-plugin-pf4-rhel9 Network Observability Operator Affected network-observability/network-observability-console-plugin-pf5-rhel9 Network Observability Operator Affected network-observability/network-observability-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel9 Red Hat Ansible Automation Platform 2 Affected automation-gateway Red Hat build of Apicurio Registry 3 Affected apicurio/apicurio-registry-ui-rhel8 Red Hat build of Apicurio Registry 3 Affected apicurio/apicurio-registry-ui-rhel9 Red Hat Hardened Images Not affected grafana12.4 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Affected satellite/iop-advisor-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-host-inventory-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-frontend-rhel9 Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-trustification-service-rhel9 Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-rhel10 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-67314 https://nvd.nist.gov/vuln/detail/CVE-2026-67314 https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields