by Kastro CVE-2026-42264
axios axios — Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Description · from the CVE record
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
Affected
ProductAffectedFixed inSource
axios>= 1.0.0, < 1.15.2–CNA
Red Hat AMQ Broker 7.13.6see advisory–redhat-SADP
Red Hat AMQ Broker 7.14.1see advisory–redhat-SADP
Red Hat Data Grid 8.6.2see advisory–redhat-SADP
Red Hat Advanced Cluster Security 4.9see advisory1779371594redhat-SADP
Red Hat Advanced Cluster Security for Kubernetes 4.10see advisory1779293013redhat-SADP
Red Hat Advanced Cluster Security for Kubernetes 4.11see advisory1783352589redhat-SADP
Red Hat Ansible Automation Platform 2.7see advisory1783919486redhat-SADP
Red Hat Migration Toolkit 1.8see advisory1783690532redhat-SADP
Red Hat Migration Toolkit for Applications 8.1see advisory1785169013redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787347991redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787226790redhat-SADP
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total