Vulnerability-Lookup

RHSA-2026:61691

Vulnerability from csaf_redhat - Published: 2026-08-31 14:35 - Updated: 2026-09-10 22:02

Summary

Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

Severity

Important

Notes

Topic: Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.

Details: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.12 images.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64		—	Vendor Fix fix

Threats

Impact Important

References

11 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:61691	self
https://access.redhat.com/security/cve/CVE-2026-67320	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-67320	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509993	external
https://www.cve.org/CVERecord?id=CVE-2026-67320	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67320	external
https://github.com/axios/axios/commit/df53d7dd99b…	external
https://github.com/axios/axios/security/advisorie…	external
https://www.vulncheck.com/advisories/axios-before…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.12 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:61691",
        "url": "https://access.redhat.com/errata/RHSA-2026:61691"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61691.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.12 Images",
    "tracking": {
      "current_release_date": "2026-09-10T22:02:58+00:00",
      "generator": {
        "date": "2026-09-10T22:02:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:61691",
      "initial_release_date": "2026-08-31T14:35:43+00:00",
      "revision_history": [
        {
          "date": "2026-08-31T14:35:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T22:02:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.12",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.12",
                  "product_id": "Red Hat Container Native Virtualization 4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin@sha256%3A777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin\u0026tag=1787651005"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T14:35:43+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61691"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:777a956a471cdf3bdc89d9ec6d688e09b33b26d4c368ce09bce767a87cc265d0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    }
  ]
}

CVE-2026-67320 (GCVE-0-2026-67320)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 15:38

Title

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

Summary

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 14:46 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/axios/axios/security/advisorie…	vendor-advisory
https://github.com/axios/axios/commit/df53d7dd99b…	patch
https://www.vulncheck.com/advisories/axios-before…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
axios	axios	Affected: 0.31.1 , < 0.33.0 (semver) Unaffected: 0.33.0 (semver)
axios	axios	Affected: 1.15.2 , < 1.18.0 (semver) Unaffected: 1.18.0 (semver)

Date Public

2026-07-06 00:00

Credits

thesmartshadow

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:46:51.783597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:38:04.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/axios",
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "lessThan": "0.33.0",
              "status": "affected",
              "version": "0.31.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.33.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/axios",
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "1.15.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                  "versionEndExcluding": "0.33.0",
                  "versionStartIncluding": "0.31.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                  "versionEndExcluding": "1.18.0",
                  "versionStartIncluding": "1.15.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "thesmartshadow"
        }
      ],
      "datePublic": "2026-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are \u003e=0.31.1 (fixed in 0.33.0) and \u003e=1.15.2 (fixed in 1.18.0)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:17.547Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gcfj-64vw-6mp9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "name": "VulnCheck Advisory: axios before 0.33.0 Prototype Pollution via Node HTTP adapter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "title": "axios before 0.33.0 Prototype Pollution via Node HTTP adapter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67320",
    "datePublished": "2026-08-01T12:22:17.547Z",
    "dateReserved": "2026-07-29T13:07:21.183Z",
    "dateUpdated": "2026-08-03T15:38:04.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:61691

CVE-2026-67320 (GCVE-0-2026-67320)

Tags

Sightings

Nomenclature