The vulnerability CVE-2026-67320 affects the axios HTTP client library used in Node.js deployments, specifically when using the HTTP adapter. Due to Prototype Pollution, request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. This manipulation enables attackers to route affected plaintext HTTP requests through a malicious proxy, potentially exposing sensitive information like authentication headers and request bodies, and allowing attackers to return their own responses. This vulnerability is present in Red Hat OpenShift Virtualization v4.12 images, specifically in versions >=0.31.1 <0.33.0 and >=1.15.2 <1.18.0 of the affected components. Red Hat has not provided a patch yet but has issued advisories describing the issue and its impact.

If exploited, this vulnerability allows an attacker to intercept and manipulate HTTP requests by routing them through a malicious proxy. This can lead to disclosure of sensitive information such as authentication headers and request bodies, and potentially allow the attacker to inject malicious responses. The integrity of application data can be compromised, and unauthorized code execution or command injection could occur depending on context. The vulnerability is rated as high severity by Red Hat.

Red Hat has not yet released a patch or fix for this vulnerability. Users are advised to ensure all previously released errata relevant to their system have been applied. Monitor Red Hat advisories for updates and apply fixes once available. No vendor-provided mitigations or workarounds are currently documented. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.