CVE-2026-40895 is a vulnerability in the follow-redirects HTTP library where custom authentication headers such as X-API-Key or X-Auth-Token are not properly stripped when following cross-domain redirects. This improper handling can lead to the unintended disclosure of sensitive authentication information to untrusted third-party domains. The flaw affects Red Hat OpenShift Container Platform versions 4.22.0 up to but not including 4.22.6. Red Hat has released OpenShift Container Platform 4.22.6 containing updated container images and RPM packages that fix this issue. The vulnerability is rated with a CVSS v3 base score of 7.5 (high severity) by Red Hat, reflecting a network attack vector with low complexity and no required privileges or user interaction, resulting in high confidentiality impact.

Exploitation of this vulnerability could lead to the unintended disclosure of sensitive authentication headers to untrusted third-party domains during HTTP redirects. This may allow attackers or unauthorized parties to obtain authentication tokens or API keys, potentially compromising access controls or sensitive operations within affected OpenShift deployments. The impact is limited to confidentiality, with no direct integrity or availability effects reported.

Red Hat has released OpenShift Container Platform 4.22.6, which includes fixes for this vulnerability. Users should upgrade their OpenShift clusters to version 4.22.6 by applying the updated container images and RPM packages available through the appropriate Red Hat release channels. Detailed upgrade instructions are provided in the Red Hat OpenShift 4.22 documentation. No additional mitigations are specified beyond applying the official update.