VDB
RHSA-2026:53840
RHSA-2026:53840
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:80462440b0f4f22bec249b45eec5f5e0f8810c8b6b0aadad76c7fb4515c3edf1_arm64 as a component of Red Hat Container Native Virtualization 4.15 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2995ef25b6e747fb77d6c83a1184b8e7b0d20d4c64a9bc230d94e98d03e8c355_amd64 as a component of Red Hat Container Native Virtualization 4.15 | * |
Timeline
- Aug 11, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:53840 advisory
- https://access.redhat.com/security/cve/CVE-2026-40175 advisory
- https://access.redhat.com/security/cve/CVE-2026-44495 advisory
- https://access.redhat.com/security/cve/CVE-2026-49978 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53840.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2457432 issue
- https://www.cve.org/CVERecord?id=CVE-2026-40175 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40175 advisory
- https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 advisory
- https://github.com/axios/axios/pull/10660 advisory
- https://github.com/axios/axios/releases/tag/v1.15.0 advisory
- https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487937 issue
- https://www.cve.org/CVERecord?id=CVE-2026-44495 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44495 advisory
- https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500695 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49978 advisory
…and 12 more