Vulnerability details
CVE-2026-44486
Red Hat OpenShift PipelinesRed Hat Ansible Automation Platform 2Red Hat Build of Podman Desktop - Tech PreviewRed Hat Enterprise Linux AI 3Red Hat Fuse 7Red Hat OpenShift AI
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
CVSS 3.1
7.5High
Official description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Profile Analyzer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| axios | axios | < 0.32.0 | CVEProject cvelistV5 (CNA) |
| axios | axios | >= 1.0.0, < 1.16.0 | CVEProject cvelistV5 (CNA) |
References and advisories
48- https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44486 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2487947 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44486.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41064 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36882 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57191 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20938 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20889 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42142 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33574 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29197 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50300 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54206 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54188 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50681 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36611 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28964 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29082 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34766 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27063 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27044 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33155 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33160 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33163 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33173 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33183 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41031 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42146 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43052 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40262 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46885 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41055 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30650 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36883 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-11
- Last updated
- 2026-09-11
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.55%
Probability of exploitation in 30 days
46.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-201Insertion of Sensitive Information Into Sent Data