Skip to content
Fencer Vulns
medium 6.5

CVE-2026-67314 json

axios before 1.18.0 Prototype Pollution via auth subfields

published 2026-07-20 3 mo ago modified 2026-09-10 1 mo ago also GHSA-xj6q-8x83-jv6g , EUVD-2026-51864

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

Patch / fix

  • npm axios 1.18.0
  • axios axios 1.18.0
  • node-axios Debian 14 1.18.0-1

debian advisories DEBIAN-CVE-2026-67314

  • grafana13.1 hummingbird 1 13.1.1-0.5.2.hum1
  • grafana13.1 hummingbird 1 13.1.1-0.5.hum1
  • jaeger hummingbird 1 2.20.0-0.8.hum1

red hat advisories RHSA-2026:50826RHSA-2026:49714RHSA-2026:48758

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1

opensuse advisories openSUSE-SU-2026:12070-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-67314 updated cvss 7.4

axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9
    affected: no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat Ansible Automation Platform 2 automation-gateway
    affected: no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10, rhtpa/rhtpa-trustification-service-rhel9
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1787339249
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1787339248
    fixed: vendor fix RHSA-2026:60388
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320
    fixed: vendor fix RHSA-2026:67714
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1789411269
    fixed: vendor fix RHSA-2026:67711
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1788775748
    fixed: vendor fix RHSA-2026:65118
show 22 more
  • Red Hat Hardened Images jaeger 2.20.0-0.8.hum1, grafana13.1 13.1.1-0.5.hum1, grafana13.1 13.1.1-0.5.2.hum1
    fixed: vendor fix RHSA-2026:50826
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 3.4 rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1793001859, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1793001896, rhoai/odh-mod-arch-mlflow-rhel9 1793001851, +3 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388
    fixed: vendor fix RHSA-2026:90321
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1790690298
    fixed: vendor fix RHSA-2026:74511
  • Red Hat Quay 3.18 quay/quay-rhel9 1791265590
    fixed: vendor fix RHSA-2026:81110
  • Red Hat Satellite 6.18 satellite/iop-vulnerability-frontend-rhel9 1789660969, satellite/iop-host-inventory-frontend-rhel9 1788322243
    fixed: vendor fix RHSA-2026:63373
  • Red Hat Satellite 6.19 satellite/iop-advisor-frontend-rhel9 1789659565, satellite/iop-vulnerability-frontend-rhel9 1789660983, satellite/iop-host-inventory-frontend-rhel9 1788260941
    fixed: vendor fix RHSA-2026:68748
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-pf4-rhel9, network-observability/network-observability-console-plugin-pf5-rhel9
    not affected: vulnerable code not present
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8
    not affected: component not present
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1787263906, rhacm2/acm-cli-rhel9 1787259085, rhacm2/prometheus-rhel9 1787263757, rhacm2/acm-grafana-rhel9 1787644958, rhacm2/acm-search-v2-rhel9 1787682112, rhacm2/node-exporter-rhel9 1787263178, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1787614805, rhacm2/acm-cli-rhel9 1786923505, rhacm2/prometheus-rhel9 1786976997, rhacm2/acm-grafana-rhel9 1787645355, rhacm2/acm-search-v2-rhel9 1787682033, rhacm2/node-exporter-rhel9 1787233241, +37 more Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-fact-rhel9 1788922546, advanced-cluster-security/rhacs-roxctl-rhel9 1789411320, advanced-cluster-security/rhacs-scanner-rhel9 1789068649, advanced-cluster-security/rhacs-rhel9-operator 1789411320, advanced-cluster-security/rhacs-collector-rhel9 1788907500, advanced-cluster-security/rhacs-operator-bundle 1789411320, +6 more Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-fact-rhel8 1788947650, advanced-cluster-security/rhacs-roxctl-rhel8 1789411269, advanced-cluster-security/rhacs-scanner-rhel8 1789068604, advanced-cluster-security/rhacs-rhel8-operator 1789411269, advanced-cluster-security/rhacs-collector-rhel8 1788908707, advanced-cluster-security/rhacs-operator-bundle 1789411269, +6 more Red Hat Hardened Images grafana12.4 12.4.6-0.2.hum1 Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-openvpn-rhel8 1789447887, rhmtc/openshift-migration-registry-rhel8 1789447846, rhmtc/openshift-migration-rhel8-operator 1789546352, rhmtc/openshift-migration-operator-bundle 1789546820, rhmtc/openshift-migration-controller-rhel8 1789377223, rhmtc/openshift-migration-log-reader-rhel8 1789375331, +4 more
    +1 more products
    Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-automl-rhel9 1792697253, +197 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    not affected: component not present
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1789145741, devspaces/server-rhel9 1789163798, devspaces/openvsx-rhel9 1789144269, devspaces/traefik-rhel9 1788882066, devspaces/udi-base-rhel9 1788883444, devspaces/code-sshd-rhel9 1789144422, +8 more Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612, devspaces/server-rhel9 1792775639, devspaces/openvsx-rhel9 1792494821, devspaces/traefik-rhel9 1792464177, devspaces/udi-base-rhel9 1792686842, devspaces/code-sshd-rhel9 1792598059, +9 more
    not affected: vulnerable code not present

10 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm axios
>=1.15.2, <1.18.0
1.18.0

Affected products

  • axios axios

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.