The vulnerability (CVE-2026-44487) affects Axios in Node.js environments used by Red Hat Satellite Lightspeed. During proxy-to-direct redirect flows, the Proxy-Authorization header containing sensitive proxy credentials may be inadvertently sent to the final redirected origin server, leading to potential exposure of these credentials to unauthorized parties. This is an information disclosure vulnerability categorized under CWE-201 (Insertion of Sensitive Information Into Sent Data). The advisory also references related CVEs CVE-2026-44488 and CVE-2026-44494. Red Hat has not provided a patch or official fix for this issue, citing lack of suitable mitigation options that meet their criteria for ease of use, applicability, and stability. The vulnerability is rated with high severity by Red Hat, with a CVSS base score of 7.5 as per Red Hat's assessment.

The impact is the potential disclosure of sensitive proxy credentials to unintended third parties when Axios follows redirects from an HTTP proxy to a non-proxied HTTPS destination. This could compromise the confidentiality of proxy authentication data, possibly allowing attackers to misuse proxy credentials. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Currently, there is no official fix or patch available for this vulnerability. Red Hat states that existing mitigation options do not meet their criteria for ease of deployment and applicability. Users are advised to consult Red Hat Satellite documentation for installation and configuration guidance. Customers with a Red Hat Technical Account Manager (TAM) can seek direct assistance regarding this CVE. Monitoring Red Hat advisories for future updates or patches is recommended.