The vulnerability CVE-2026-44486 affects Axios, a promise-based HTTP client used in Node.js environments, specifically its HTTP adapter. When Axios is configured to use an authenticated proxy and automatic HTTP redirects are enabled, it may leak the Proxy-Authorization header containing proxy credentials to the redirect target if the redirect bypasses the proxy. This leads to potential disclosure of sensitive proxy credentials to unintended remote servers. Red Hat OpenShift Container Platform versions >=4.12 <4.13 and >=4.14 <4.14.71 are affected. Red Hat has released version 4.14.71 with updated container images and RPM packages to fix this issue. The vulnerability is rated as Important by Red Hat with a CVSS v3 base score of 7.5 (high severity). No known exploits in the wild have been reported. Mitigation options other than upgrading are not currently available or do not meet Red Hat's criteria for deployment.

The vulnerability allows an attacker controlling or monitoring the redirect target to obtain proxy credentials that were intended to be kept confidential. This can lead to unauthorized use of the proxy credentials, potentially compromising network security or allowing further attacks through the proxy. The impact is limited to information disclosure; integrity and availability are not affected. The risk is higher in environments where applications interact with untrusted HTTP origins and use authenticated proxies with automatic redirects enabled.

Red Hat recommends upgrading affected OpenShift Container Platform versions to 4.14.71 or later, which includes fixes for this vulnerability. No other effective mitigations are currently available or meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updated release notes and upgrade instructions. Applying the update fully and promptly is the primary recommended action.