Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Summary
| CVE | CVE-2025-62718 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-09 15:16:08 UTC |
| Updated | 2026-07-21 12:17:10 UTC |
| Description | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0. |
Risk And Classification
Primary CVSS: v4.0 6.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.000410000 probability, percentile 0.125120000 (date 2026-04-21)
Problem Types: CWE-441 | CWE-918 | CWE-1289 | CWE-441 CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') | CWE-918 CWE-918: Server-Side Request Forgery (SSRF) | CWE-1289 Improper Validation of Unsafe Equivalence in Input
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| 3.1 | [email protected] | Primary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| 3.1 | ADP | CVSS | 7 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
LowIntegrity
LowAvailability
NoneSub Conf.
LowSub Integrity
LowSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Axios | Axios | affected >= 1.0.0, < 1.15.0 | Not specified |
| CNA | Axios | Axios | affected < 0.31.0 | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:2.5.20260422-3.el8ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:2.5.20260422-3.el9ap * rpm | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 3.2.0 | Not specified | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1781116645 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1781116658 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1781116387 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1781116392 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1781116667 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.6 | unaffected 1778511348 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.8 | unaffected 1778383863 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.11.2 | unaffected 1778508956 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.11.2 | unaffected 1778510461 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.14 | unaffected 1783451729 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1779371594 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1779293013 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 | unaffected 1780082949 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1779784904 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.8 | unaffected 1776784286 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1777903262 * rpm | Not specified |
| ADP | Red Hat | Red Hat Discovery 2 | unaffected 1778156756 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit 1.8 | unaffected 1783690532 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1780467029 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1780467147 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1779189627 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1778473763 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1778666987 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.27 | unaffected 1776744110 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.27 | unaffected 1776795511 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1776202125 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1776191302 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1776151124 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1776151272 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1776151106 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1776151270 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1776155669 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1776149682 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1776151134 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1776151277 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.1 | unaffected 1779822261 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.12 | unaffected 1779811412 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.14 | unaffected 1779689392 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.15 | unaffected 1780891395 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.16 | unaffected 1779204086 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.17 | unaffected 1779922205 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.9 | unaffected 1779811473 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1779971506 * rpm | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Gatekeeper 3 | Not specified | Not specified |
| ADP | Red Hat | Gatekeeper 3 | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Network Observability Operator | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apache Camel - HawtIO 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Data Grid 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Developer Hub | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Fuse 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Process Automation 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Profile Analyzer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Profile Analyzer | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:8491 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8493 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| datatracker.ietf.org/doc/html/rfc3986 | [email protected] | datatracker.ietf.org | Technical Description |
| access.redhat.com/errata/RHSA-2026:14937 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20889 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41928 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24853 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/releases/tag/v1.15.0 | [email protected] | github.com | Product, Release Notes |
| access.redhat.com/errata/RHSA-2026:24471 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24977 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36882 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22629 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/pull/10661 | [email protected] | github.com | Issue Tracking, Patch |
| access.redhat.com/errata/RHSA-2026:21017 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8484 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:9742 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26010 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20938 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:16874 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19375 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| datatracker.ietf.org/doc/html/rfc1034 | [email protected] | datatracker.ietf.org | Technical Description |
| github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:10175 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22465 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13826 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24766 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62718.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8483 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/releases/tag/v0.31.0 | [email protected] | github.com | Release Notes |
| github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:17699 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24866 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:23361 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Exploit, Mitigation, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:24761 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13571 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19712 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22840 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8490 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17657 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2025-62718 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/pull/10688 | [email protected] | github.com | Issue Tracking |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-09T15:01:48.111Z | Reported to Red Hat. |
| ADP | 2026-04-09T14:31:46.067Z | Made public. |
Solutions
ADP: RHSA-2026:24761: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
ADP: RHSA-2026:26010: Cluster Observability Operator 1.5.0
ADP: RHSA-2026:16874: Network Observability (NETOBSERV) 1.11.2
ADP: RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14
ADP: RHSA-2026:20938: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:24766: Red Hat Ansible Automation Platform 2.5
ADP: RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6
ADP: RHSA-2026:9742: Red Hat Developer Hub 1.8
ADP: RHSA-2026:13826: Red Hat Developer Hub 1.9
ADP: RHSA-2026:14937: Red Hat Discovery 2
ADP: RHSA-2026:41928: Red Hat Migration Toolkit 1.8
ADP: RHSA-2026:24977: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:19712: Red Hat OpenShift AI 3.3
ADP: RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27
ADP: RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6
ADP: RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0
ADP: RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1
ADP: RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2
ADP: RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3
ADP: RHSA-2026:22629: Red Hat Quay 3.12
ADP: RHSA-2026:21017: Red Hat Quay 3.14
ADP: RHSA-2026:24853: Red Hat Quay 3.15
ADP: RHSA-2026:19375: Red Hat Quay 3.16
ADP: RHSA-2026:22465: Red Hat Quay 3.17
ADP: RHSA-2026:22840: Red Hat Quay 3.1
ADP: RHSA-2026:23361: Red Hat Quay 3.9
ADP: RHSA-2026:24471: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:13571: Streams for Apache Kafka 3.2.0
ADP: RHSA-2026:17657: multicluster engine for Kubernetes 2.6
ADP: RHSA-2026:17699: multicluster engine for Kubernetes 2.8
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.