VDB
GHSA-fvcv-3m26-pcqx
GHSA-fvcv-3m26-pcqx
PUBLISHED
CVSS 4.800000190734863 MEDIUM
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | kibana-8.17 | 0, 0, 0 |
| chainguard | opensearch-dashboards-2-fips | 0, 0, 0 |
| chainguard | kibana-8.19 | 0, 0, 0 |
| wolfi | kubeflow-katib | 0, 0, 0 |
| chainguard | jitsucom-jitsu | 0, 0, 0 |
| wolfi | langfuse-3 | 0, 0, 0 |
| chainguard | nextcloud-server-33 | 0, 0, 0 |
| chainguard | langfuse-fips-3 | 0, 0, 0 |
| chainguard | opensearch-dashboards-2 | 0, 0, 0 |
| npm | axios | |
| chainguard | librechat | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0, 0, 0 |
| wolfi | saf | 0, 0, 0 |
| wolfi | kubeflow-centraldashboard | 0, 0, 0 |
| chainguard | wazuh-dashboard | 0, 0, 0 |
| chainguard | lerna | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0, 0, 0 |
| chainguard | nextcloud-server-31 | 0, 0, 0 |
| chainguard | kubeflow-centraldashboard | 0, 0, 0 |
| chainguard | gitlab-rails-ce-19.1 | 0, 0, 0 |
…and 28 more
Timeline
- Apr 10, 2026 CVE Published
- Apr 11, 2026 Security Advisory
- May 20, 2026 CVE Updated
References
- https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx url
- https://nvd.nist.gov/vuln/detail/CVE-2026-40175 advisory
- https://github.com/axios/axios/pull/10660 url
- https://github.com/axios/axios/pull/10688 url
- https://github.com/axios/axios/releases/tag/v1.15.0 url
- https://github.com/axios/axios package
- https://github.com/axios/axios/releases/tag/v0.31.0 url
- https://github.com/axios/axios/pull/10660#issuecomment-4224168081 url
- https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c url
- https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 url
- https://cert-portal.siemens.com/productcert/html/ssa-876049.html url