VDB
RHSA-2026:56357
RHSA-2026:56357
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform/automation-portal@sha256:9595023cdb01463dcab779b7e041987c6d00769bb174f43aadd477293a521508_amd64 as a component of Red Hat Ansible Automation Platform 2.2 | *, * |
Timeline
- Aug 18, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:56357 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-45623 advisory
- https://access.redhat.com/security/cve/CVE-2026-46625 advisory
- https://access.redhat.com/security/cve/CVE-2026-54272 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69153 advisory
- https://access.redhat.com/security/cve/CVE-2026-69192 advisory
- https://access.redhat.com/security/cve/CVE-2026-73086 advisory
- https://access.redhat.com/security/cve/CVE-2026-73088 advisory
- https://access.redhat.com/security/cve/CVE-2026-73089 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56357.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488934 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9595 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9595 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/facebook/create-react-app/pull/7444 advisory
…and 63 more