Red Hat's OpenShift Virtualization v4.14 images include a high-severity vulnerability identified as CVE-2026-44492 in the Axios HTTP client library. This vulnerability arises because Axios does not properly normalize IPv4-mapped IPv6 addresses, enabling an attacker to bypass NO_PROXY environment variable restrictions intended to block direct access to certain IPv4 addresses. By crafting a request URL using the IPv4-mapped IPv6 format, the attacker can route requests through a proxy, potentially exposing internal services or sensitive data such as cloud instance metadata credentials. The advisory notes no available patch or mitigation that meets Red Hat's standards for deployment and stability. The vulnerability is scored with a CVSS v3.1 base score of 8.6 (high severity) by Red Hat. The advisory also references CVE-2026-44494 but provides no specific details. Red Hat recommends applying all previously released errata relevant to the system before updating to the new images.

The vulnerability allows bypassing proxy restrictions configured via the NO_PROXY environment variable, potentially exposing internal services or sensitive information that should be inaccessible. This can lead to unauthorized access to internal network resources or sensitive data such as cloud instance metadata credentials. The impact is rated high severity by Red Hat with a CVSS v3.1 score of 8.6, indicating a significant risk if exploited. No known exploits are reported in the wild at this time.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, applicability, and stability is available. Red Hat advises ensuring that all previously released errata relevant to your system have been applied before updating to the OpenShift Virtualization v4.14 images. Monitor Red Hat advisories for future updates or patches addressing this vulnerability. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance.