The vulnerability (CVE-2026-44487) is an information disclosure flaw in Axios, a popular HTTP client for Node.js. When Axios is used with an authenticated HTTP proxy and follows redirects from an HTTP proxy to a non-proxied HTTPS destination, the Proxy-Authorization header intended only for the proxy may be forwarded to the final origin server. This can lead to the exposure of sensitive proxy credentials to unintended third parties. The issue is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and related CWEs. Red Hat Satellite and its container image satellite/iop-advisor-frontend-rhel9 are affected. Red Hat has not provided a patch or fix for this vulnerability as of the advisory date. The vulnerability has a high severity rating based on Red Hat's assessment, although no CVSS score is provided. No known exploits in the wild have been reported.

The vulnerability can lead to the unintended disclosure of sensitive proxy credentials when Axios follows certain redirect flows involving authenticated HTTP proxies. This exposure could allow an attacker who controls or observes the final redirected destination to obtain proxy credentials, potentially compromising proxy security and enabling unauthorized proxy usage or further attacks. There is no reported impact on integrity or availability. The issue affects confidentiality only.

Currently, there is no available fix or patch that meets Red Hat's criteria for ease of use, deployment, and stability. Users are advised to review their use of Axios with authenticated HTTP proxies and redirects carefully. Consider avoiding configurations that involve proxy-to-direct redirect flows or using alternative HTTP clients that do not exhibit this behavior until a fix is provided. Monitor Red Hat advisories for updates or patches. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. No specific workaround is provided in the advisory.