CVE-2026-67314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67314", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:06:35.179Z", "datePublished": "2026-08-01T12:22:16.603Z", "dateUpdated": "2026-08-03T18:06:09.036Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-01T12:22:16.603Z"}, "datePublic": "2026-07-06T00:00:00.000Z", "title": "axios before 1.18.0 Prototype Pollution via auth subfields", "descriptions": [{"lang": "en", "value": "axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "cweId": "CWE-1321", "type": "CWE"}]}], "affected": [{"vendor": "axios", "product": "axios", "defaultStatus": "unaffected", "packageURL": "pkg:npm/axios", "versions": [{"version": "1.15.2", "status": "affected", "versionType": "semver", "lessThan": "1.18.0"}, {"version": "1.18.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "1.15.2", "versionEndExcluding": "1.18.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-xj6q-8x83-jv6g)"}, {"name": "VulnCheck Advisory: axios before 1.18.0 Prototype Pollution via auth subfields", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"}], "credits": [{"lang": "en", "value": "lullu57", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T18:04:28.314777Z", "id": "CVE-2026-67314", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:06:09.036Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67314", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T18:04:28.314777Z"}}}], "references": [{"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:05:00.459Z"}}], "cna": {"title": "axios before 1.18.0 Prototype Pollution via auth subfields", "credits": [{"lang": "en", "type": "reporter", "value": "lullu57"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "axios", "product": "axios", "versions": [{"status": "affected", "version": "1.15.2", "lessThan": "1.18.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:npm/axios", "defaultStatus": "unaffected"}], "datePublic": "2026-07-06T00:00:00.000Z", "references": [{"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g", "name": "GitHub Security Advisory (GHSA-xj6q-8x83-jv6g)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields", "name": "VulnCheck Advisory: axios before 1.18.0 Prototype Pollution via auth subfields", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.18.0", "versionStartIncluding": "1.15.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-01T12:22:16.603Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67314", "state": "PUBLISHED", "dateUpdated": "2026-08-03T18:06:09.036Z", "dateReserved": "2026-07-29T13:06:35.179Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:16.603Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/axios", "product": "axios", "vendor": "axios", "versions": [{"lessThan": "1.18.0", "status": "affected", "version": "1.15.2", "versionType": "semver"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6FB01C7C-87AA-49E4-ABCE-504EAA17D65A", "versionEndExcluding": "1.18.0", "versionStartIncluding": "1.15.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions."}], "id": "CVE-2026-67314", "lastModified": "2026-09-01T15:40:20.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67314", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T18:04:28.314777Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:01.407", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth", "id": "2510030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-915", "details": ["axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.", "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure."], "name": "CVE-2026-67314", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "jaeger", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-01T12:22:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67314\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67314\nhttps://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g\nhttps://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.2,1.18.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.18.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "axios", "source": "cna", "vendor": "axios"}, "product": "axios", "vendor": "axios"}], "created": "2026-08-01T13:45:02.896060+00:00", "updated": "2026-08-04T22:15:03.897570+00:00", "vendors": ["axios", "axios$PRODUCT$axios"]}