CVE-2026-118258
Description
A flaw was found in i18next-http-backend. A remote attacker who controls language or namespace input values can cause information disclosure by injecting unexpected query parameters into translation request URLs. Because the component fails to sanitize query separators during URL interpolation, an attacker can manipulate request parameters to access unauthorized translation data across namespaces or alter backend request behavior.
Statement
This vulnerability is rated as having a Low severity impact because successful exploitation requires specific non-default configuration patterns where translation templates interpolate untrusted parameters directly into query strings. Across Red Hat environments such as OpenShift and Ansible Automation Platform user interfaces, standard static paths and predetermined locales are typically utilized, heavily limiting practical exposure. Even if manipulated, the attack only affects outgoing localization requests without granting administrative access or compromising underlying cluster and host integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
