Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Summary
| CVE | CVE-2026-40175 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-10 20:16:22 UTC |
| Updated | 2026-07-21 12:18:26 UTC |
| Description | Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1. |
Risk And Classification
Primary CVSS: v3.1 4.8 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.000280000 probability, percentile 0.081340000 (date 2026-04-22)
Problem Types: CWE-113 | CWE-444 | CWE-918 | CWE-915 | CWE-113 CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | CWE-444 CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CWE-918 CWE-918: Server-Side Request Forgery (SSRF) | CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | ADP | CVSS | 9 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 9 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Axios | Axios | affected >= 1.0.0, < 1.15.0 | Not specified |
| CNA | Axios | Axios | affected < 0.31.0 | Not specified |
| ADP | Siemens | GWAP | affected V3.1.1 custom | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:2.6.9-1.el9ap * rpm | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 3.2.0 | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.1 | unaffected 1777128790 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.6 | unaffected 1778511348 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.8 | unaffected 1778383863 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.9 | unaffected 1777301444 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.11.2 | unaffected 1778508956 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.11.2 | unaffected 1778510461 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.14 | unaffected 1783451729 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.15 | unaffected 1776927126 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1779371594 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.8 | unaffected 1776784286 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1777903262 * rpm | Not specified |
| ADP | Red Hat | Red Hat Discovery 2 | unaffected 1778156756 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit 1.8 | unaffected 1780590717 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1779189627 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1778473763 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1779189704 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1778666987 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.14 | unaffected 1777997704 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.15 | unaffected 1777994748 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.16 | unaffected 1776827996 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.19 | unaffected 1779249923 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.20 | unaffected 1778645099 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.20 | unaffected 1778638503 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.21 | unaffected 1778539338 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.21 | unaffected 1778539219 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.27 | unaffected 1776744110 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.27 | unaffected 1776795511 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1776202125 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1776191302 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1776151124 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1776151272 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1776151106 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1776151270 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1776155669 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1776149682 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1776151134 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1776151277 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1776250950 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1776216284 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1776269713 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1776672801 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1776778645 * rpm | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Gatekeeper 3 | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apache Camel - HawtIO 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Kueue | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Podman Desktop - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Red Hat Data Grid 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Developer Hub | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Fuse 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Process Automation 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Profile Analyzer | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/html/ssa-876049.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| access.redhat.com/errata/RHSA-2026:8491 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8493 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8499 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:14937 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17474 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20041 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 | [email protected] | github.com | Patch |
| github.com/axios/axios/releases/tag/v1.15.0 | [email protected] | github.com | Product, Release Notes |
| access.redhat.com/errata/RHSA-2026:36882 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8501 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-40175 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:14774 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:10104 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/pull/10660 | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Patch |
| access.redhat.com/errata/RHSA-2026:8484 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:9742 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20938 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24762 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:11414 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx | [email protected] | github.com | Exploit, Mitigation, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:16874 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:10153 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:15091 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:10175 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8500 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13826 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13548 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8483 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/releases/tag/v0.31.0 | [email protected] | github.com | Release Notes |
| access.redhat.com/errata/RHSA-2026:13542 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17699 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:10172 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/pull/10660 | [email protected] | github.com | Issue Tracking, Patch |
| access.redhat.com/errata/RHSA-2026:13571 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19712 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8490 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17657 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/pull/10688 | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:17468 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25041 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-10T20:02:10.296Z | Reported to Red Hat. |
| ADP | 2026-04-10T19:23:52.285Z | Made public. |
Solutions
ADP: RHSA-2026:24762: Red Hat Ansible Automation Platform 2.6 for RHEL 9
ADP: RHSA-2026:16874: Network Observability (NETOBSERV) 1.11.2
ADP: RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14
ADP: RHSA-2026:13548: Red Hat Advanced Cluster Management for Kubernetes 2.15
ADP: RHSA-2026:20938: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:9742: Red Hat Developer Hub 1.8
ADP: RHSA-2026:13826: Red Hat Developer Hub 1.9
ADP: RHSA-2026:14937: Red Hat Discovery 2
ADP: RHSA-2026:25041: Red Hat Migration Toolkit 1.8
ADP: RHSA-2026:19712: Red Hat OpenShift AI 3.3
ADP: RHSA-2026:15091: Red Hat OpenShift Container Platform 4.14
ADP: RHSA-2026:14774: Red Hat OpenShift Container Platform 4.15
ADP: RHSA-2026:10104: Red Hat OpenShift Container Platform 4.16
ADP: RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19
ADP: RHSA-2026:17468: Red Hat OpenShift Container Platform 4.20
ADP: RHSA-2026:17474: Red Hat OpenShift Container Platform 4.21
ADP: RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27
ADP: RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6
ADP: RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0
ADP: RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1
ADP: RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2
ADP: RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3
ADP: RHSA-2026:8499: Red Hat Satellite 6.18
ADP: RHSA-2026:8500: Red Hat Satellite 6.18
ADP: RHSA-2026:8501: Red Hat Satellite 6.18
ADP: RHSA-2026:10172: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:10153: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:13571: Streams for Apache Kafka 3.2.0
ADP: RHSA-2026:13542: multicluster engine for Kubernetes 2.1
ADP: RHSA-2026:17657: multicluster engine for Kubernetes 2.6
ADP: RHSA-2026:17699: multicluster engine for Kubernetes 2.8
ADP: RHSA-2026:11414: multicluster engine for Kubernetes 2.9
There are currently no legacy QID mappings associated with this CVE.