Vulnerability details
CVE-2026-44487
Red Hat OpenShift PipelinesRed Hat Ansible Automation Platform 2Red Hat Build of Podman Desktop - Tech PreviewRed Hat Enterprise Linux AI 3Red Hat Fuse 7Red Hat OpenShift AI
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
CVSS 4.0
8.2High
Official description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Profile Analyzer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| axios | axios | < 0.32.0 | CVEProject cvelistV5 (CNA) |
| axios | axios | >= 1.0.0, < 1.16.0 | CVEProject cvelistV5 (CNA) |
References and advisories
54- https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44487 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2487948 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41064 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36882 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57191 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20938 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20889 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34374 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42142 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33574 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29197 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50300 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54206 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54188 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36611 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28964 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29082 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29864 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40795 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27063 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40792 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27044 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40768 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33155 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33160 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33163 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33173 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33183 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41031 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42146 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43052 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40262 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34530 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34527 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34525 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46885 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41055 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30650 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36883 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-11
- Last updated
- 2026-09-11
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.68%
Probability of exploitation in 30 days
52.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-201Insertion of Sensitive Information Into Sent Data