The vulnerability CVE-2026-40175 affects the Axios library, a promise-based HTTP client, through prototype pollution. This flaw allows an attacker to manipulate object attributes dynamically, which can escalate to remote code execution or cloud environment compromise when combined with specific gadget attack chains in third-party dependencies. Red Hat's analysis indicates that in OpenShift Virtualization, the vulnerable Axios component is either not present in final container images or not exploitable due to browser runtime limitations in certain product streams (4.12 and 4.13). Red Hat has released OpenShift Virtualization v4.14 images containing fixes and updates to address this vulnerability. The advisory notes that while a patch exists in Axios, some residual risks related to HTTP header sanitation and SSRF remain. The vulnerability is tracked under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), CWE-606, and CWE-79.

If exploited, this vulnerability could allow an attacker to modify sensitive application data or execute unauthorized code, potentially leading to remote code execution or full cloud compromise, including bypassing AWS IMDSv2 protections. However, Red Hat's assessment reduces the impact in their OpenShift Virtualization products due to the absence of the vulnerable component in final container images or the inability to exploit it in browser runtime environments. The severity is rated as high by Red Hat, reflecting the potential impact if the vulnerability were exploitable in the affected environments.

A patch is available and included in the OpenShift Virtualization v4.14 images released by Red Hat. Users should update to these fixed images to remediate the vulnerability. Red Hat advises applying all previously released errata relevant to the system before updating. The vulnerable Axios component is not present in some container images or not exploitable in certain product streams, reducing the immediate risk. No additional mitigations are specified beyond applying the official update.