CVE-2026-42041

high Red Hat
CVSS v3 Base Score
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS Score
0.1%
Exploitation probability in 30 days
Top 65% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Published: April 24, 2026 (76 days ago)
Last Modified: April 24, 2026
Vendor: Red Hat
Fix Available: ✓ Yes
Source: REDHAT

Description

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.

CWE

CWE-915

Affected Products

Cryostat 4Gatekeeper 3Migration Toolkit for Applications 8Migration Toolkit for ContainersOpenShift PipelinesOpenShift Service Mesh 3Red Hat 3scale API Management Platform 2Red Hat Advanced Cluster Management for Kubernetes 2Red Hat Ansible Automation Platform 2Red Hat build of Apache Camel - HawtIO 4

Fix Status

✅ Fix Available

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com