--- id: CVE-2026-67314 title: >- axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js) summary: >- axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-po… severity: high cwe: - CWE-1321 - CWE-915 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67314' references: - url: 'https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g' label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields label: disclosure@vulncheck.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67314.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67314' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510030' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67314' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67314' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:49714' - url: 'https://access.redhat.com/errata/RHSA-2026:48758' - url: 'https://access.redhat.com/errata/RHSA-2026:59566' - url: 'https://access.redhat.com/errata/RHSA-2026:59583' - url: 'https://access.redhat.com/errata/RHSA-2026:65514' - url: 'https://access.redhat.com/errata/RHSA-2026:63373' - url: 'https://access.redhat.com/errata/RHSA-2026:63355' - url: 'https://access.redhat.com/errata/RHSA-2026:66084' - url: 'https://access.redhat.com/errata/RHSA-2026:66523' - url: 'https://access.redhat.com/errata/RHSA-2026:50826' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:68765' - url: 'https://access.redhat.com/errata/RHSA-2026:68748' - url: 'https://access.redhat.com/errata/RHSA-2026:68755' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' tags: - nvd - csaf - vex - red-hat ingestedAt: '2026-08-02T07:18:01.844Z' epss: 0.00411 epssPercentile: 0.32567 vendor: Red Hat product: Red Hat OpenShift AI (RHOAI) affected: - migration_toolkit_for_applications 8 - migration_toolkit_for_containers - multicluster_engine_for_kubernetes - network_observability_operator - openshift_pipelines - advanced_cluster_security 4 - ansible_automation_platform 2 - build_of_apicurio_registry 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_dev_spaces - quay 3 - satellite 6 - trusted_profile_analyzer - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - hardened_images - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.9 - satellite 6.18 - satellite 6.19 patched: - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - hardened_images - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.9 - satellite 6.18 - satellite 6.19 cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N' cvssSource: vendor --- ## Overview axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:49714** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49714) - **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758) - **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566) - **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583) - **RHSA-2026:65514** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65514) - **RHSA-2026:63373** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63373) - **RHSA-2026:63355** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63355) - **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, … · no fix planned: OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67314.json) - **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084) - **RHSA-2026:66523** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66523) - **RHSA-2026:50826** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50826) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)