CVE-2026-44487 is an information disclosure vulnerability in Axios when used in Node.js environments with authenticated HTTP proxies. During proxy-to-direct redirect flows, the Proxy-Authorization header, which contains sensitive proxy credentials, may be inadvertently sent to the final redirected origin server, exposing these credentials to unintended third parties. This vulnerability affects the Red Hat Satellite Lightspeed component, specifically the satellite/iop-vulnerability-frontend-rhel9 container image. Red Hat has published an advisory (RHSA-2026:34525) but has not released a patch or fix. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), CWE-770, and CWE-915. The advisory notes that mitigation options do not currently meet Red Hat’s criteria for ease of use and deployment.

The vulnerability can lead to the disclosure of sensitive proxy credentials to unintended third parties during HTTP redirect flows in applications using Axios with authenticated HTTP proxies. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time. The impact is rated as high due to the potential exposure of sensitive authentication information.

Currently, no official fix or patch is available from Red Hat for this vulnerability. The advisory states that existing mitigation options do not meet Red Hat’s criteria for widespread applicability or stability. Users should monitor Red Hat’s official advisories for updates and consider restricting or avoiding the use of authenticated HTTP proxies with Axios in redirect scenarios until a fix is provided. Consulting with Red Hat support or a Technical Account Manager (TAM) is recommended for tailored guidance.