VDB
RHSA-2026:59155
RHSA-2026:59155
PUBLISHED
CVSS 7.699999809265137 HIGH
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:3f3f70bed536434e03c7034ae3cc59c4e57e400fd2d820c4b4efb21657d0b1b3_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9@sha256:8c0d85087272e98a18174a4368986c346dd5a9a8f23f70dc70583e396b242dd9_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-tech-preview/metrics-service-rhel9@sha256:4ed89e35683a99a1d2eeca17c7041604cdb198cf0dd049fc0cad491ae2788c79_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-rhel9-operator@sha256:8d6f8f27b06f810ca1fdc732a674fbb58b2236e3fa8dd8daa2d6f25a2b98a275_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9-operator@sha256:c41de85652a15374f763f15d037cb3a5d78dcedc97caac537e3b68182ef808d5_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/eda-controller-ui-rhel9@sha256:3c3ded3816cf04a849f3595eb0fe08becef11b20b6e246dbb1a4448f913c64f3_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/hub-rhel9@sha256:e1b8fc8c36e99401562ef42c26c42fe95a1ba16ba154d69dda13cc732b32e808_s390x as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/receptor-rhel9@sha256:ab8d7421c71bdeec2ad144ef8688c3aa73da11ef2c406d31bbd7529abccf638d_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:e98cc409807f96e7f07e00ea19eacc5c550e223f5b61ee263c90556faefe22dc_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9@sha256:754949f204abbbbed0108e866075987ce67fcac13633be2a5709a19fcfff9656_s390x as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:3f99115f04ecdda40b64a297602563e9b148d75a6635456704f966c6f7f2e186_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:da35f30bf23aa959569dd64c146c36d685ace17be5459cadcfcfe1d081c7c59a_s390x as a component of Red Hat Ansible Automation Platform 2.6 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:29890751840322ea5840c510e8efc755a224b7eaf54ee67d7e13a251802a245b_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9@sha256:6b1283691011e086c7f295e261c6eba82164b07f480f3ba6ca7ed10ba2624efa_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9@sha256:3d0564d0ccf9fa52f9d5390abb99062c0f9e7eb7f87922d56088d993ca47ef33_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/gateway-proxy-rhel9@sha256:2975f0e1aa9c98684e1f97eea95a687f9ed30429f0ef26e85edb3b4006a83729_s390x as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/mcp-tools-rhel9@sha256:13aa402b85e4250170a9034c328ac9e683a358b7e895d819948658f6028d845f_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:f87c4a2dbf87521902c9029a0804d4b6581ff78683e7bc21bc8e5e8094c339e3_amd64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-tech-preview/mcp-server-rhel9@sha256:8783f03687d5593aa035b49927f0bef9e90d2aa8fc7f68f7e14bf8445c3ba759_arm64 as a component of Red Hat Ansible Automation Platform 2.6 | *, * |
| Red Hat | registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9@sha256:92c23dae889cf6b2e0d4e6e608bf1d5348642f8a47fbe5f912080c9483d1d9a2_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 | * |
…and 98 more
Timeline
- Aug 24, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59155 advisory
- https://access.redhat.com/security/cve/CVE-2025-62718 advisory
- https://access.redhat.com/security/cve/CVE-2025-69223 advisory
- https://access.redhat.com/security/cve/CVE-2025-69227 advisory
- https://access.redhat.com/security/cve/CVE-2025-69228 advisory
- https://access.redhat.com/security/cve/CVE-2026-12143 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-15307 advisory
- https://access.redhat.com/security/cve/CVE-2026-1615 advisory
- https://access.redhat.com/security/cve/CVE-2026-44545 advisory
- https://access.redhat.com/security/cve/CVE-2026-44705 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/cve/CVE-2026-67325 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69243 advisory
- https://access.redhat.com/security/cve/CVE-2026-69244 advisory
- https://access.redhat.com/security/cve/CVE-2026-71364 advisory
- https://access.redhat.com/security/cve/CVE-2026-71365 advisory
- https://access.redhat.com/security/cve/CVE-2026-71366 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
…and 117 more