Red Hat Security Advisory: OpenShift Virtualization v4.16 Images
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 5 Nov 2026, 14:51 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 11 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.
What to do
AI-suggested
Red Hat has released updated OpenShift Virtualization v4.16 images that address this vulnerability. Users should ensure all previously released errata are applied before updating. The vulnerable Axios component is a build-time dependency not shipped in some container images, reducing exploitability in those cases. For product streams where the vulnerable component is present but not exploitable due to runtime constraints, the impact is low. Users should follow Red Hat's official update procedures as detailed in their advisory and apply the updated images promptly.
Description
CVE-2026-40175 is a prototype pollution vulnerability found in the Axios HTTP client library, which can be exploited via specific gadget attack chains in third-party dependencies. This vulnerability may lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2 protections. Red Hat products incorporating the vulnerable Axios library are affected, but some container images and product streams are not exploitable due to runtime environment constraints. Red Hat has released updated OpenShift Virtualization v4.16 images addressing this issue.