VDB
RHSA-2026:50681
RHSA-2026:50681
PUBLISHED
CVSS 8.5 HIGH
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver@sha256:ac7a80106ed0b7c6d31c843783002280d74f3cb99fdcb63b1ee8fbdfac6f80ff_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-operator@sha256:a7bcb125b64f2cb739963748dfbadd5866319d50bf0293539286bb2dee4aa23d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:01a932f68886384fcb16a7dc933522d782612d4cb66e5eb50a3628724984faee_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-catalogd-rhel8@sha256:9a9a966d25c033665eba1855a90c55696c5c64fbdf0f738cd89796a437967997_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-api-rhel8@sha256:7f639ce1f44164150b9a252143d3be664c8727c0211d635f96e10fcef39d182d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry@sha256:37e1b94c86559c6a8440e76d2749904a4fe6565f0d55bf471b0e83f81936cdfb_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-libvirt-machine-controllers@sha256:cfc58919dd3ca1acf75a882b7424ac763a7aaeee7e9ecc4d102e824792faacc4_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover@sha256:7a6ec73825118fd104c9b3d595581a65e4e4f83f82c96b81675c441f13628b7d_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-operator@sha256:4967906ca3d9bba80f345ccd290c1435aa35b7968c11906ef9f7c881eafe1c8f_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler@sha256:5f354725aea23b5f6a905b48de6444fb004de67f6ef4a019e0651da4b42ca46f_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kuryr-cni-rhel8@sha256:de2dd628d2198ba7c60edae288ba1a4502b362c8c1f8941dab2489cf2449ccc9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-operator@sha256:0edec5f4e0c6adb6cc88a4e0060be410f83f38715bab945945985550114526ba_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-operator-rhel8@sha256:03735d39913e206005f103d6c9ade8d4f1fba967b17f631e3ba1401f618bd502_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-operator@sha256:4773f6a729825a926aefa5fe4d504d072f940c68d28bf6d196277abf847e22df_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prom-label-proxy@sha256:03cbf7dff1b764e840ba8b850a19b4a1fd81b5bbf366a9de933e3a0895e64248_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-cluster-api-rhel8-operator@sha256:5bd1e03b053788222ce8b98a8ba813a481fef7aaccc456b3eb4d7ae7d0661896_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-policy-controller-rhel8@sha256:7bb92092d564928d7fc211f2b9dda47ab853c8d650b9678aae123304fe89f19f_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel8@sha256:36d8ef30058c81cb248ec4936bf5e1c7aeee2919ee22ab10e221ed36b9d77f4e_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-snapshot-controller-rhel8@sha256:414a1554ac9159fa8a1e9e1bf63245a1ea3df75d09fede6ce322c9a813dc5c54_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics@sha256:e0b78aa46903c786a6968710e3b35085cbb55eb58d08e4dfd0fa1672a1454cc9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
…and 655 more
Timeline
- Aug 12, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50681 advisory
- https://access.redhat.com/security/cve/CVE-2026-44486 advisory
- https://access.redhat.com/security/cve/CVE-2026-49332 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50681.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487947 issue
- https://www.cve.org/CVERecord?id=CVE-2026-44486 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44486 advisory
- https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2483253 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49332 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49332 advisory