CVE-2026-44490

medium Red Hat
CVSS v3 Base Score
4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Published: June 11, 2026 (28 days ago)
Last Modified: June 11, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as prototype pollution, allows an upstream dependency to modify the fundamental behavior of JavaScript objects. When this occurs, Axios can unknowingly incorporate these altered values, leading to two potential consequences. This can result in sensitive information being inadvertently included in network requests, or cause application instability and crashes, leading to a denial of service.

CWE

CWE-915

Affected Products

Cryostat 4Gatekeeper 3Migration Toolkit for Applications 8Migration Toolkit for ContainersMulticluster Engine for KubernetesNetwork Observability OperatorOpenShift PipelinesOpenShift Service Mesh 2OpenShift Service Mesh 3Red Hat 3scale API Management Platform 2

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com