Bug 2510030 (CVE-2026-67314)

Summary:	CVE-2026-67314 axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abuckta, akostadi, amasferr, anthomas, aruklets, dbosanac, dkeler, dkuc, dmayorov, doconnor, dschmidt, dymurray, ehelms, ewittman, ggainey, gparvin, ibolton, janstey, jlanda, jlledo, jmatthew, jmontleo, jpasqual, jreimann, juwatts, kaycoth, kshier, mdellweg, mdessi, mhulan, mrizzi, nipatil, nmoumoul, orabin, osousa, pantinor, pcattana, pcreech, pgaikwad, prwatson, rchan, rhaigner, rjohnson, rkubis, sdawley, simaishi, slucidi, smallamp, sseago, stcannon, suppawar, teagle, thason, tmalecek, tsedmik, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-01 13:04:13 UTC

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.