CVE-2026-101907: axios Confused Deputy
CVSS: 7.0v4.0HighAwaiting analysis
AliasesUBUNTU-CVE-2026-101907DEBIAN-CVE-2026-101907CGA-28vr-wr2h-6fjmCGA-392g-mv27-wcr8CGA-5hj6-j9c5-mw9mCGA-5wc8-pq5r-v7hfCGA-6774-cx34-8fv7CGA-67vc-3c9w-6xm7CGA-76hp-3fc8-3cjwCGA-78m8-hjfp-rcfhCGA-85c7-h9mc-x9qxCGA-8w6w-p42f-mwmmCGA-gff9-rfh2-7gv3CGA-gh36-vj7q-j5hqCGA-j6ff-655g-8cpfCGA-mm79-3pvj-2cr4CGA-mqx8-6fr9-pr5qCGA-pwmm-r723-6prgCGA-q7m3-jq96-36x7CGA-q9pw-342p-26r4CGA-qrgh-h5mc-7c9fCGA-r4h3-9f7q-x3j4CGA-rjch-8p3q-gmqmCGA-rm26-rvm4-fvhrCGA-rpgq-2vm5-vjq4CGA-v48m-h8cc-h8p3CGA-xg83-qx2r-wfv5CGA-xh9r-xjch-wvmgGHSA-r4gj-5m52-g5whCGA-2jff-w799-32mjCGA-2q49-8j58-9w5xCGA-377f-76c9-386cCGA-3g9f-g596-chfhCGA-3hpr-p8pg-8g62CGA-3m8v-p7gq-p3xpCGA-48v6-6hp3-qx3fCGA-4cj5-6rvq-cv4rCGA-4f3q-j9vm-w8vqCGA-4g83-2g6v-88vjCGA-4hpp-398v-222wCGA-4mj5-5c76-9699CGA-547c-hwq6-7689CGA-5j8c-v9gm-frqpCGA-5q5q-4xr3-7657CGA-62jq-gq8x-6c94CGA-65qw-p7mw-c35wCGA-6fh7-6fxh-rrmfCGA-6j7g-6vfh-vh55CGA-6j8v-q338-7pm5CGA-6phm-3636-46qcCGA-6qrq-xrj2-rgfvCGA-6r2j-hq7r-w5rgCGA-7772-88pf-fv2wCGA-7fvm-3pjg-h997CGA-7h7g-cp3f-8xcxCGA-7j3r-vrhj-f374CGA-7v35-2gg4-8x52CGA-8244-vf7r-fv3pCGA-89gg-q77c-4g33CGA-8c99-h4m3-93rrCGA-8j8r-rp96-9p76CGA-8qfq-v4p7-qj3mCGA-8r2v-q299-w86wCGA-8x39-f5x5-j682CGA-8xwg-9h67-gcx5CGA-9869-p8gp-c595CGA-9v54-79fw-5387CGA-9wqx-m8r5-hv4vCGA-cp59-3xrp-76xmCGA-cpfp-hxrr-mmg3CGA-f269-58j6-3874CGA-f859-q3vw-w736CGA-f996-gprx-jqfvCGA-fcvm-frc2-c328CGA-fjj9-6fmv-x555CGA-fmq3-p3j4-mr6hCGA-frp3-vh84-f79rCGA-fx6g-qqr5-9rh5CGA-g62w-wm4h-7j9cCGA-gc5p-fq3r-fgcvCGA-gcgq-369h-2x6wCGA-h8fv-wpw7-8qh2CGA-h92m-79j6-5g2mCGA-h94p-5vxw-3f9mCGA-hh23-45jv-x586CGA-j9wf-qr6r-fpv8CGA-j9xm-25fv-3cp2CGA-jf97-rjp4-ph73CGA-jhw5-xrj2-v62vCGA-jqhq-jhw5-pjq7CGA-jr7h-c8rm-f4c8CGA-jrm3-q8m8-gwg8CGA-m383-hxvg-vr67CGA-mm9v-3hx5-457vCGA-mvcc-xc3j-h5c6CGA-mwmm-9rr4-hgcxCGA-p3f2-35w6-745pCGA-p467-j84m-jm2gCGA-pq3r-w8m4-hm3gCGA-pqq5-4fgm-5xmqCGA-q4m2-hwq9-r3p5CGA-q85j-mfx2-cvgcCGA-qc9f-vjfr-7g98CGA-qpq8-jcmr-m62qCGA-qwh7-wqrj-m2vfCGA-r4qp-7294-cqj7CGA-r58p-3m66-j3jjCGA-r6w4-7h84-mwxgCGA-r7rv-5wj5-f63jCGA-rjcg-g8h9-59mvCGA-rjjv-j626-qhrpCGA-v6v7-v7r8-vjw2CGA-v7rh-3xcp-c74hCGA-vc8g-7qv8-6j6wCGA-vcw2-c3mf-7685CGA-vf47-vpf3-8v69CGA-vh9r-76h2-c656CGA-w2vx-xmcq-qq9cCGA-w3v3-936j-hx2fCGA-w7m9-5xxj-892cCGA-w88m-c8r2-4x48CGA-wfxw-hwmv-639cCGA-whh4-jq28-j76qCGA-wjf5-9xrx-w8fwCGA-x688-46g2-8hhgCGA-xm8p-jfh9-rqffCGA-xpmj-cfvm-67v9CGA-j2j4-w352-457hCGA-mjrp-6rh6-h73hCGA-5xcg-772r-r845CGA-gh3q-wx5j-557q
Published 28-09-2026Last modified 28-09-2026
Vulnerability summary
CVE-2026-101907 is a high (CVSS 7.0) Confused Deputy vulnerability in axios. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.2% of scored vulnerabilities.
CVSS score
7.0/10
010
High · v4.0 (CVE.org)EPSS score
0.41%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 28-09-2026Last modifiedVulnerability information updated.
Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · NpmEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- NVDNIST7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202619-10-2026
EPSS score0.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-441Unintended Proxy or Intermediary ('Confused Deputy')The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Chainguard48 products
- awx< 24.6.1-r66
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
Wolfi7 products
- kubeflow-centraldashboard< 2.0.0-r5
- langfuse-3< 3.225.11-r2
- langfuse-3-worker< 3.225.11-r2
- lerna< 10.0.1-r8
- nextcloud-server-33< 33.0.9-r1
Axios1 product
- axios≥ 1.17.0, < 1.20.0
Debian1 product
- node-axiosAll versions (No fix recorded) | < 1.20.0-1
Npm1 product
- axios≥ 1.17.0, < 1.20.0
Ubuntu1 product
- node-axiosAll versions (No fix recorded)
6 vendors · 59 products
References
10 links
- github.com/axios/axiosPACKAGE