VDB
RHSA-2026:65126
RHSA-2026:65126
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in Eclipse Vert.x. The `DefaultRedirectHandler` in `vertx-core` improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9@sha256:31991a9edb680e39f3738fadba586e2a88fa144c16b28b07730ea42fcbce3172_arm64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:998c151d4a7c618e3465687d55cc5f3a7bcf97b27bb603999e516f80afe1c8da_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel9@sha256:1d1665918e56e79943f52e9505ccca84c843b9f04da60b3467c6822ab381ce1f_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel9@sha256:b539d55f3ddc92adf3308cab6cc060fda3d600e01c615f5e621ea5f66d9eb391_arm64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:f9e11c743a08cad0748773fe89a7dda27cd6a42e25018dc0616052f4df6fffb1_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-model-metadata-collection-rhel9@sha256:dbb455fbe0828dbeb955a976ea0f42ccb3db2f32e8540e01f85f13f3075058fb_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9@sha256:16460c761360a89eea02239722a1d34e61cc3e99cb7116361c2a620ba10be1d6_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:2f4ab0e14df06f0e558bb73eeb2ee7b7bdab3cf013a012aca27580f986642677_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:520837d415654b6bd3d5d2f724d3b26dffffc965b76ffa2868837b68951cdc26_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:fcc80994975e15d9601e648713c6c3fc820b4bc025b15eb31a80c69694634f26_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel9@sha256:b7842bb39fce0bfa25664305e00a0382dbcf369f8df00e54ba7d70aee4b9c193_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel9@sha256:6bda6609bade20dc664cf266213f8ab657aa7d4b02a8c6ff8bef0cb3fdb4e9a0_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:2d14894f815ad8a71593dd56de41e67843d0ab000279fd0bfb034c106447ce6a_arm64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-rhel9@sha256:95e268cb7ccaa66e04f6f71d5b9407216a9b9242b980e87f77c10f4c209f4999_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5ff076f464e3184bf6a4aa5f3fa28442d9063a1e7c96c985b352142392f90f6b_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:e910488975b28286d1e38ead00be371fcc0a678e9f1246e2db9f70d41dbeabc7_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:8409b8f6f309a29b5b05a72186bb62623da2f59f21203ae7b476944657a7dc46_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:4ffc56a9a2a1face43e86d4abfc06b3f9138a03b24e6231c52089e18c70ca39c_ppc64le as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-kserve-router-rhel9@sha256:d9180f62a4c25562b571ec9b33a4851e39b4e01200cdb0b4dd72ae3833c65841_arm64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:26d9256029f78df1b0d16a5d388d6caece5ad0c0639a76a99dbcc9f32c281002_amd64 as a component of Red Hat OpenShift AI 2.25 | *, *, * |
…and 189 more
Timeline
- Sep 8, 2026 CVE Published
- Sep 11, 2026 Security Advisory
- Oct 14, 2026 CVE Updated
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2510017 issue
- https://nvd.nist.gov/vuln/detail/CVE-2026-67313 advisory
- https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 advisory
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson advisory
- https://access.redhat.com/errata/RHSA-2026:65126 advisory
- https://access.redhat.com/security/cve/CVE-2025-61729 advisory
- https://access.redhat.com/security/cve/CVE-2025-67030 advisory
- https://access.redhat.com/security/cve/CVE-2026-12151 advisory
- https://access.redhat.com/security/cve/CVE-2026-12243 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-15075 advisory
- https://access.redhat.com/security/cve/CVE-2026-15154 advisory
- https://access.redhat.com/security/cve/CVE-2026-15378 advisory
- https://access.redhat.com/security/cve/CVE-2026-15581 advisory
- https://access.redhat.com/security/cve/CVE-2026-16745 advisory
- https://access.redhat.com/security/cve/CVE-2026-18608 advisory
- https://access.redhat.com/security/cve/CVE-2026-18611 advisory
- https://access.redhat.com/security/cve/CVE-2026-18617 advisory
- https://access.redhat.com/security/cve/CVE-2026-18620 advisory
- https://access.redhat.com/security/cve/CVE-2026-18621 advisory
…and 720 more