Axios CVE-2026-44494: What Red Hat Customers Should Verify in OpenShift
Red Hat scope
Red Hat's CVE-2026-44494 record identifies a flaw in Axios that can escalate an existing Object.prototype pollution condition into a full man-in-the-middle attack. Red Hat rates the issue Important with a CVSS 3.1 base score of 8.7 and gives the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
The affected component is Axios. The GitHub advisory lists versions from 1.0.0 through 1.15.x and identifies 1.16.0 as the patched release. Red Hat lists OpenShift Container Platform among the products that contain the affected library. Its guidance says a product marked affected includes all minor releases unless the advisory states otherwise, and that fixes arrive through Red Hat errata.
What the Red Hat listing means
An affected product listing means Red Hat determined that the product ships one or more affected components. It does not mean every cluster is exploitable. The application still needs a path that pollutes Object.prototype and a later Axios request that inherits the polluted proxy value.
OpenShift customers should separate the platform package from workloads. Red Hat's errata address the packages Red Hat maintains. A customer-built Node.js image can contain its own Axios package, so it must be rebuilt from an updated dependency even after the cluster is current.
The technical path
The HTTP adapter reads config.proxy from the merged request configuration. Because proxy is not in the Axios defaults, an object can have no own property and still inherit an attacker-supplied one. If setProxy() receives that value, it can change the request host and port.
The attacker proxy can see request headers, credentials, cookies, and bodies. It can also replace responses. Red Hat's description states that no direct user interaction is required once an existing pollution primitive is present. The separate pollution source is the main reason the issue is conditional.
Customer verification checklist
List every OpenShift namespace and runtime image digest. Query the final image's package inventory for Axios below 1.16.0. Include applications, jobs, operators, and sidecars. Record the image owner and the request paths that use Axios.
Check the current Red Hat security advisory for the installed OpenShift Container Platform release. Apply the errata that include CVE-2026-44494. Then rebuild application images with Axios 1.16.0 or later and confirm the fixed package inside the new image.
Review object-parsing code for recursive merges and dangerous keys. A team can reduce exposure by rejecting untrusted __proto__, constructor, and prototype keys, but Red Hat says a supported mitigation is not available. Those checks should not be recorded as a replacement for the errata and package update.
Exposure context
The ZoomEye Search title="OpenShift" returned 5,443 matches on 2026-11-03 UTC. The CVE filter returned 0. This count is a broad view of OpenShift-related product titles and should not be compared to Red Hat's affected-product inventory without additional evidence. It does not confirm that a deployment is vulnerable.
Top comments (0)