CVE-2026-101899
Description
A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.
Statement
A moderate information disclosure vulnerability was found in Axios, a promise-based HTTP client for Node.js that Red Hat Hardened Images (Hummingbird) ships as a dependency of its grafana12.4, grafana13.1, and grafana13.2 container images. Axios evaluates Classless Inter-Domain Routing (CIDR) notation entries in NO_PROXY proxy-bypass lists as textual hostname suffixes instead of IP address ranges. When a request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured, the CIDR bypass rule fails to match and the request is sent through the configured proxy. As a result, an adversary with access to the configured proxy server can observe and modify URLs, headers, and bodies of plaintext HTTP traffic intended for internal network services, and can observe connection metadata and CONNECT requests for HTTPS traffic. Red Hat rated this flaw as moderate severity (CVSS 6.5), consistent with the upstream assessment of moderate severity (CVSS 6.9). The resolution of this issue in the affected Hardened Images streams is delegated to the Hummingbird image maintainers, and a fix has been delivered through the affected image streams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The affected Red Hat Hardened Images releases containing the fix have been delivered; update to the latest grafana12.4, grafana13.1, and grafana13.2 image releases to resolve this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
