Axios versions used in Red Hat Advanced Cluster Security for Kubernetes prior to the 4.9.7 update improperly handle hostname normalization when evaluating NO_PROXY environment variables. This flaw allows attackers to craft requests targeting loopback addresses that bypass NO_PROXY rules, causing requests to be routed through the configured proxy instead of being excluded. This behavior can be exploited to perform SSRF attacks, potentially accessing sensitive internal or loopback services. Exploitation requires the attacker to influence URLs passed to axios in a server-side context, have both HTTP_PROXY and NO_PROXY configured, and rely on a proxy that can intercept or be compromised to misuse the rerouted traffic. Red Hat has issued a security advisory and released updated RHACS images containing fixes for this vulnerability. No alternative mitigations meeting Red Hat's criteria are currently available.

Successful exploitation of this vulnerability can lead to SSRF, allowing attackers to access internal or loopback services that should be protected by NO_PROXY rules. However, the impact is limited by the need for specific environmental conditions and attacker capabilities, including control over server-side axios URL inputs and proxy configurations. The vulnerability is rated as high severity by Red Hat due to the potential confidentiality impact, though integrity and availability impacts are low.

Red Hat advises upgrading to RHACS version 4.9.7 or later to address this vulnerability. No other mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Users should apply the updated images provided by Red Hat as soon as possible to benefit from the security patches.