{"id":"CVE-2026-67314","title":"axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js)","summary":"axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-po…","severity":"high","cwe":["CWE-1321","CWE-915"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67314","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67314.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67314"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510030"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67314"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67314"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:49714"},{"url":"https://access.redhat.com/errata/RHSA-2026:48758"},{"url":"https://access.redhat.com/errata/RHSA-2026:59566"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:65514"},{"url":"https://access.redhat.com/errata/RHSA-2026:63373"},{"url":"https://access.redhat.com/errata/RHSA-2026:63355"},{"url":"https://access.redhat.com/errata/RHSA-2026:66084"},{"url":"https://access.redhat.com/errata/RHSA-2026:66523"},{"url":"https://access.redhat.com/errata/RHSA-2026:50826"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:68765"},{"url":"https://access.redhat.com/errata/RHSA-2026:68748"},{"url":"https://access.redhat.com/errata/RHSA-2026:68755"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-02T07:18:01.844Z","epss":0.00353,"epssPercentile":0.28929,"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["migration_toolkit_for_applications 8","migration_toolkit_for_containers","multicluster_engine_for_kubernetes","network_observability_operator","openshift_pipelines","advanced_cluster_security 4","ansible_automation_platform 2","build_of_apicurio_registry 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_dev_spaces","quay 3","satellite 6","trusted_profile_analyzer","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","ansible_automation_platform 2.1","hardened_images","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.9","satellite 6.18","satellite 6.19"],"patched":["advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","ansible_automation_platform 2.1","hardened_images","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.9","satellite 6.18","satellite 6.19"],"cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"vendor","slug":"CVE-2026-67314","body":"## Overview\n\naxios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:49714** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49714)\n- **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758)\n- **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566)\n- **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583)\n- **RHSA-2026:65514** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65514)\n- **RHSA-2026:63373** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63373)\n- **RHSA-2026:63355** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63355)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, … · no fix planned: Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67314.json)\n- **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084)\n- **RHSA-2026:66523** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66523)\n- **RHSA-2026:50826** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50826)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201864,"id":"CVE-2026-67314","ts":1789399915493,"field":"cvss","old":null,"new":"7.4"},{"seq":201863,"id":"CVE-2026-67314","ts":1789399915493,"field":"severity","old":"none","new":"high"},{"seq":200594,"id":"CVE-2026-67314","ts":1789397462879,"field":"cvss","old":"7.4","new":null},{"seq":200593,"id":"CVE-2026-67314","ts":1789397462879,"field":"severity","old":"high","new":"none"},{"seq":198511,"id":"CVE-2026-67314","ts":1789392048098,"field":"cvss","old":null,"new":"7.4"},{"seq":198510,"id":"CVE-2026-67314","ts":1789392048098,"field":"severity","old":"none","new":"high"},{"seq":196302,"id":"CVE-2026-67314","ts":1789383663477,"field":"cvss","old":"7.4","new":null},{"seq":196301,"id":"CVE-2026-67314","ts":1789383663477,"field":"severity","old":"high","new":"none"},{"seq":195231,"id":"CVE-2026-67314","ts":1789380514292,"field":"cvss","old":null,"new":"7.4"},{"seq":195230,"id":"CVE-2026-67314","ts":1789380514292,"field":"severity","old":"none","new":"high"},{"seq":194018,"id":"CVE-2026-67314","ts":1789378600011,"field":"cvss","old":"7.4","new":null},{"seq":194017,"id":"CVE-2026-67314","ts":1789378600011,"field":"severity","old":"high","new":"none"},{"seq":192805,"id":"CVE-2026-67314","ts":1789376445056,"field":"cvss","old":null,"new":"7.4"},{"seq":192804,"id":"CVE-2026-67314","ts":1789376445056,"field":"severity","old":"none","new":"high"},{"seq":191592,"id":"CVE-2026-67314","ts":1789373519343,"field":"cvss","old":"7.4","new":null},{"seq":191591,"id":"CVE-2026-67314","ts":1789373519343,"field":"severity","old":"high","new":"none"},{"seq":190377,"id":"CVE-2026-67314","ts":1789369394428,"field":"cvss","old":null,"new":"7.4"},{"seq":190376,"id":"CVE-2026-67314","ts":1789369394428,"field":"severity","old":"none","new":"high"},{"seq":189164,"id":"CVE-2026-67314","ts":1789368317247,"field":"cvss","old":"7.4","new":null},{"seq":189163,"id":"CVE-2026-67314","ts":1789368317247,"field":"severity","old":"high","new":"none"},{"seq":187947,"id":"CVE-2026-67314","ts":1789365184806,"field":"cvss","old":null,"new":"7.4"},{"seq":187946,"id":"CVE-2026-67314","ts":1789365184806,"field":"severity","old":"none","new":"high"},{"seq":186734,"id":"CVE-2026-67314","ts":1789363375976,"field":"cvss","old":"7.4","new":null},{"seq":186733,"id":"CVE-2026-67314","ts":1789363375976,"field":"severity","old":"high","new":"none"},{"seq":185520,"id":"CVE-2026-67314","ts":1789361163287,"field":"cvss","old":null,"new":"7.4"},{"seq":185519,"id":"CVE-2026-67314","ts":1789361163287,"field":"severity","old":"none","new":"high"},{"seq":184307,"id":"CVE-2026-67314","ts":1789358232620,"field":"cvss","old":"7.4","new":null},{"seq":184306,"id":"CVE-2026-67314","ts":1789358232620,"field":"severity","old":"high","new":"none"},{"seq":182558,"id":"CVE-2026-67314","ts":1789354259582,"field":"cvss","old":null,"new":"7.4"},{"seq":182557,"id":"CVE-2026-67314","ts":1789354259582,"field":"severity","old":"none","new":"high"},{"seq":181351,"id":"CVE-2026-67314","ts":1789353217689,"field":"cvss","old":"7.4","new":null},{"seq":181350,"id":"CVE-2026-67314","ts":1789353217689,"field":"severity","old":"high","new":"none"},{"seq":180144,"id":"CVE-2026-67314","ts":1789350211957,"field":"cvss","old":null,"new":"7.4"},{"seq":180143,"id":"CVE-2026-67314","ts":1789350211957,"field":"severity","old":"none","new":"high"},{"seq":178937,"id":"CVE-2026-67314","ts":1789348178192,"field":"cvss","old":"7.4","new":null},{"seq":178936,"id":"CVE-2026-67314","ts":1789348178192,"field":"severity","old":"high","new":"none"},{"seq":177730,"id":"CVE-2026-67314","ts":1789346318907,"field":"cvss","old":null,"new":"7.4"},{"seq":177729,"id":"CVE-2026-67314","ts":1789346318907,"field":"severity","old":"none","new":"high"},{"seq":176523,"id":"CVE-2026-67314","ts":1789343094020,"field":"cvss","old":"7.4","new":null},{"seq":176522,"id":"CVE-2026-67314","ts":1789343094020,"field":"severity","old":"high","new":"none"},{"seq":174640,"id":"CVE-2026-67314","ts":1789334825492,"field":"cvss","old":null,"new":"7.4"},{"seq":174639,"id":"CVE-2026-67314","ts":1789334825492,"field":"severity","old":"none","new":"high"},{"seq":173435,"id":"CVE-2026-67314","ts":1789333568533,"field":"cvss","old":"7.4","new":null},{"seq":173434,"id":"CVE-2026-67314","ts":1789333568533,"field":"severity","old":"high","new":"none"},{"seq":172249,"id":"CVE-2026-67314","ts":1789331043440,"field":"cvss","old":null,"new":"7.4"},{"seq":172248,"id":"CVE-2026-67314","ts":1789331043440,"field":"severity","old":"none","new":"high"},{"seq":171063,"id":"CVE-2026-67314","ts":1789328669669,"field":"cvss","old":"7.4","new":null},{"seq":171062,"id":"CVE-2026-67314","ts":1789328669669,"field":"severity","old":"high","new":"none"},{"seq":169858,"id":"CVE-2026-67314","ts":1789327095981,"field":"cvss","old":null,"new":"7.4"},{"seq":169857,"id":"CVE-2026-67314","ts":1789327095981,"field":"severity","old":"none","new":"high"}]}