{
  "threat_severity" : "Important",
  "public_date" : "2026-06-11T15:32:03Z",
  "bugzilla" : {
    "description" : "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
    "id" : "2487942",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-915",
  "details" : [ "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.", "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server." ],
  "statement" : "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application's dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42078",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
    "package" : "automation-gateway-0:2.5.20260715-1.el8ap"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42078",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
    "package" : "automation-gateway-0:2.5.20260715-1.el9ap"
  }, {
    "product_name" : "Red Hat Data Grid 8.6.2",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:41951",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8",
    "package" : "axios"
  }, {
    "product_name" : "multicluster engine for Kubernetes 2.6",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41055",
    "cpe" : "cpe:/a:redhat:multicluster_engine:2.6::el9",
    "package" : "multicluster-engine/console-mce-rhel9:1783351002"
  }, {
    "product_name" : "multicluster engine for Kubernetes 2.8",
    "release_date" : "2026-06-28T00:00:00Z",
    "advisory" : "RHSA-2026:30650",
    "cpe" : "cpe:/a:redhat:multicluster_engine:2.8::el9",
    "package" : "multicluster-engine/console-mce-rhel9:1782157085"
  }, {
    "product_name" : "multicluster engine for Kubernetes 2.9",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36883",
    "cpe" : "cpe:/a:redhat:multicluster_engine:2.9::el9",
    "package" : "multicluster-engine/console-mce-rhel9:1783348181"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.11",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41064",
    "cpe" : "cpe:/a:redhat:acm:2.11::el9",
    "package" : "rhacm2/console-rhel9:1783350952"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.13",
    "release_date" : "2026-06-28T00:00:00Z",
    "advisory" : "RHSA-2026:30651",
    "cpe" : "cpe:/a:redhat:acm:2.13::el9",
    "package" : "rhacm2/console-rhel9:1782157514"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.14",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36882",
    "cpe" : "cpe:/a:redhat:acm:2.14::el9",
    "package" : "rhacm2/console-rhel9:1783451729"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.9",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20938",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.9::el8",
    "package" : "advanced-cluster-security/rhacs-main-rhel8:1779371594"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security for Kubernetes 4.10",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20889",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.10::el8",
    "package" : "advanced-cluster-security/rhacs-main-rhel8:1779293013"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.7",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42142",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.7::el9",
    "package" : "ansible-automation-platform-27/gateway-rhel9:1783919486"
  }, {
    "product_name" : "Red Hat Container Native Virtualization 4.13",
    "release_date" : "2026-07-07T00:00:00Z",
    "advisory" : "RHSA-2026:36108",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.13::el9",
    "package" : "container-native-virtualization/kubevirt-console-plugin-rhel9:1782426816"
  }, {
    "product_name" : "Red Hat Container Native Virtualization 4.14",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33005",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.14::el9",
    "package" : "container-native-virtualization/kubevirt-console-plugin-rhel9:1782356760"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36754",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1783448184"
  }, {
    "product_name" : "Red Hat Developer Hub 1.9",
    "release_date" : "2026-06-16T00:00:00Z",
    "advisory" : "RHSA-2026:26234",
    "cpe" : "cpe:/a:redhat:rhdh:1.9::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1781187342"
  }, {
    "product_name" : "Red Hat Developer Hub 1.9",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33574",
    "cpe" : "cpe:/a:redhat:rhdh:1.9::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1782761244"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2026-06-24T00:00:00Z",
    "advisory" : "RHSA-2026:29197",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-ui-rhel9:1782166952"
  }, {
    "product_name" : "Red Hat Migration Toolkit 1.8",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:41928",
    "cpe" : "cpe:/a:redhat:rhmt:1.8::el8",
    "package" : "rhmtc/openshift-migration-ui-rhel8:1783690532"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.14",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:36611",
    "cpe" : "cpe:/a:redhat:openshift:4.14::el9",
    "package" : "openshift4/ose-console:1782911957"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.15",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:28964",
    "cpe" : "cpe:/a:redhat:openshift:4.15::el9",
    "package" : "openshift4/ose-console:1782127091"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:29082",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "openshift4/ose-console-rhel9:1782244020"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:29082",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1782243791"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.19",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:29864",
    "cpe" : "cpe:/a:redhat:openshift:4.19::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1782171032"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.20",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:29800",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1782313844"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.20",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:40795",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "openshift4/ose-agent-installer-ui-rhel9:1784148076"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-06-23T00:00:00Z",
    "advisory" : "RHSA-2026:27044",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1781731914"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:40792",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-agent-installer-ui-rhel9:1784134078"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-07-07T00:00:00Z",
    "advisory" : "RHSA-2026:34794",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1782913451"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces 3.29",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36820",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3.29::el9",
    "package" : "devspaces/code-rhel9:1782498475"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces 3.29",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36820",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3.29::el9",
    "package" : "devspaces/dashboard-rhel9:1782498792"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33155",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel8:1781937133"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33155",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/kiali-rhel8:1782287580"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.0",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33160",
    "cpe" : "cpe:/a:redhat:service_mesh:3.0::el9",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201894"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.0",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33160",
    "cpe" : "cpe:/a:redhat:service_mesh:3.0::el9",
    "package" : "openshift-service-mesh/kiali-rhel9:1782201833"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.1",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33163",
    "cpe" : "cpe:/a:redhat:service_mesh:3.1::el9",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201696"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.1",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33163",
    "cpe" : "cpe:/a:redhat:service_mesh:3.1::el9",
    "package" : "openshift-service-mesh/kiali-rhel9:1782201537"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.2",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33173",
    "cpe" : "cpe:/a:redhat:service_mesh:3.2::el9",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201851"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.2",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33173",
    "cpe" : "cpe:/a:redhat:service_mesh:3.2::el9",
    "package" : "openshift-service-mesh/kiali-rhel9:1782201812"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.3",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33183",
    "cpe" : "cpe:/a:redhat:service_mesh:3.3::el9",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782231869"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 3.3",
    "release_date" : "2026-06-29T00:00:00Z",
    "advisory" : "RHSA-2026:33183",
    "cpe" : "cpe:/a:redhat:service_mesh:3.3::el9",
    "package" : "openshift-service-mesh/kiali-rhel9:1782201466"
  }, {
    "product_name" : "Red Hat Quay 3.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41031",
    "cpe" : "cpe:/a:redhat:quay:3.10::el8",
    "package" : "quay/quay-rhel8:1783750447"
  }, {
    "product_name" : "Red Hat Quay 3.12",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42146",
    "cpe" : "cpe:/a:redhat:quay:3.12::el8",
    "package" : "quay/quay-rhel8:1783751865"
  }, {
    "product_name" : "Red Hat Quay 3.15",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42796",
    "cpe" : "cpe:/a:redhat:quay:3.15::el8",
    "package" : "quay/quay-rhel8:1784351966"
  }, {
    "product_name" : "Red Hat Quay 3.16",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41066",
    "cpe" : "cpe:/a:redhat:quay:3.16::el9",
    "package" : "quay/quay-rhel9:1783955846"
  }, {
    "product_name" : "Red Hat Quay 3.9",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40262",
    "cpe" : "cpe:/a:redhat:quay:3.9::el8",
    "package" : "quay/quay-rhel8:1784125838"
  }, {
    "product_name" : "Red Hat Satellite 6.19",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34525",
    "cpe" : "cpe:/a:redhat:satellite:6.19::el9",
    "package" : "satellite/iop-vulnerability-frontend-rhel9:1781174698"
  }, {
    "product_name" : "Red Hat Satellite 6.19",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34527",
    "cpe" : "cpe:/a:redhat:satellite:6.19::el9",
    "package" : "satellite/iop-host-inventory-frontend-rhel9:1782253070"
  }, {
    "product_name" : "Red Hat Satellite 6.19",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34530",
    "cpe" : "cpe:/a:redhat:satellite:6.19::el9",
    "package" : "satellite/iop-advisor-frontend-rhel9:1782243376"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42085",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/rhtas-console-ui-rhel9:1784105894"
  } ],
  "package_state" : [ {
    "product_name" : "Cryostat 4",
    "fix_state" : "Not affected",
    "package_name" : "axios",
    "cpe" : "cpe:/a:redhat:cryostat:4"
  }, {
    "product_name" : "Cryostat 4",
    "fix_state" : "Not affected",
    "package_name" : "cryostat-openshift-console-plugin-npm",
    "cpe" : "cpe:/a:redhat:cryostat:4"
  }, {
    "product_name" : "Gatekeeper 3",
    "fix_state" : "Not affected",
    "package_name" : "gatekeeper/gatekeeper-rhel9",
    "cpe" : "cpe:/a:redhat:gatekeeper:3"
  }, {
    "product_name" : "Migration Toolkit for Applications 8",
    "fix_state" : "Not affected",
    "package_name" : "mta/mta-ui-rhel8",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:8"
  }, {
    "product_name" : "Migration Toolkit for Applications 8",
    "fix_state" : "Affected",
    "package_name" : "mta/mta-ui-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:8"
  }, {
    "product_name" : "Network Observability Operator",
    "fix_state" : "Affected",
    "package_name" : "network-observability/network-observability-console-plugin-pf4-rhel9",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1"
  }, {
    "product_name" : "Network Observability Operator",
    "fix_state" : "Affected",
    "package_name" : "network-observability/network-observability-console-plugin-pf5-rhel9",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1"
  }, {
    "product_name" : "Network Observability Operator",
    "fix_state" : "Affected",
    "package_name" : "network-observability/network-observability-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-hub-ui-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-hub-ui-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/kiali-operator-bundle",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/kiali-rhel9-operator",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "3scale-amp21/system",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "3scale-amp22/system",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "3scale-amp2/system-rhel7",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "3scale-amp2/system-rhel8",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "3scale-amp2/system-rhel9",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat AMQ Broker 7",
    "fix_state" : "Affected",
    "package_name" : "axios",
    "cpe" : "cpe:/a:redhat:amq_broker:7"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/automation-dashboard-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "automation-controller",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "automation-hub",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "automation-platform-ui",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "python3.11-galaxy-ng",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "python3.12-galaxy-ng",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "python3x-galaxy-ng",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "python-galaxy-ng",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat build of Apache Camel for Spring Boot 4",
    "fix_state" : "Not affected",
    "package_name" : "axios",
    "cpe" : "cpe:/a:redhat:camel_spring_boot:4"
  }, {
    "product_name" : "Red Hat build of Apache Camel - HawtIO 4",
    "fix_state" : "Affected",
    "package_name" : "axios",
    "cpe" : "cpe:/a:redhat:apache_camel_hawtio:4"
  }, {
    "product_name" : "Red Hat build of Apicurio Registry 3",
    "fix_state" : "Not affected",
    "package_name" : "apicurio/apicurio-registry-ui-rhel8",
    "cpe" : "cpe:/a:redhat:apicurio_registry:3"
  }, {
    "product_name" : "Red Hat build of Apicurio Registry 3",
    "fix_state" : "Not affected",
    "package_name" : "apicurio/apicurio-registry-ui-rhel9",
    "cpe" : "cpe:/a:redhat:apicurio_registry:3"
  }, {
    "product_name" : "Red Hat Build of Podman Desktop - Tech Preview",
    "fix_state" : "Will not fix",
    "package_name" : "rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10",
    "cpe" : "cpe:/a:redhat:podman_desktop:0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana-pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai3/bootc-cuda-rhel9",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai3/bootc-gaudi-rhel9",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai3/bootc-rocm-rhel9",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai3/disk-image-cuda-rhel9",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Will not fix",
    "package_name" : "axios",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-dashboard-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-mlflow-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-automl-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-autorag-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-eval-hub-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-gen-ai-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-mod-arch-maas-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-mlflow-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-mod-arch-model-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-ui-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/kubevirt-console-plugin",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat Trusted Profile Analyzer",
    "fix_state" : "Affected",
    "package_name" : "rhtpa/rhtpa-trustification-service-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_profile_analyzer:2"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/automation-portal",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/bootc-automation-portal-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-44494\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44494\nhttps://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh" ],
  "name" : "CVE-2026-44494",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}