CVE-2026-67314

Description

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS Trends

Current EPSS score: 0.35%• Percentile: 29%

Techniques & Countermeasures

• CWE-1321•Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Systems

• chainguard•awx

  < 24.6.1-r45

• chainguard•gitlab-rails-ce-18.1

  all

• chainguard•gitlab-rails-ce-19.0

  all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.7-r7

• chainguard•gitlab-rails-ce-fips-19.2

  all | < 19.2.5-r2

• chainguard•jitsucom-jitsu-console

  < 2.11.0-r30

• chainguard•kibana-8.17

  < 8.17.10-r31

• chainguard•kibana-8.17-bitnami

  < 8.17.10-r31

• chainguard•kibana-8.17-iamguarded

  < 8.17.10-r31

• chainguard•kibana-8.19

  < 8.19.18-r2

• chainguard•kibana-8.19-bitnami

  < 8.19.18-r2

• chainguard•kibana-8.19-iamguarded

  < 8.19.18-r2

• chainguard•kibana-9.0

  < 9.0.8-r34

• chainguard•kibana-9.0-bitnami

  < 9.0.8-r34

• chainguard•kibana-9.0-iamguarded

  < 9.0.8-r34

• chainguard•kibana-9.1

  < 9.1.10-r30

• chainguard•kibana-9.1-iamguarded

  < 9.1.10-r30

• chainguard•kibana-9.2

  < 9.2.8-r18

• chainguard•kibana-9.2-iamguarded

  < 9.2.8-r18

• chainguard•kibana-9.3

  < 9.3.8-r1

• chainguard•kibana-9.3-iamguarded

  < 9.3.8-r1

• chainguard•kibana-9.4

  < 9.4.4-r3

• chainguard•kibana-9.4-iamguarded

  < 9.4.4-r3

• chainguard•kubeflow-centraldashboard

  < 1.10.0-r26

• chainguard•langfuse-2

  < 2.95.12-r35

• chainguard•langfuse-2-worker

  < 2.95.12-r35

• chainguard•langfuse-3

  < 3.223.0-r0

• chainguard•langfuse-3-compat

  < 3.225.7-r6

• chainguard•langfuse-3-worker

  < 3.223.0-r0

• chainguard•langfuse-fips-2

  < 2.95.12-r38

• chainguard•langfuse-fips-2-worker

  < 2.95.12-r38

• chainguard•langfuse-fips-3

  < 3.223.0-r0

• chainguard•langfuse-fips-3-worker

  < 3.223.0-r0

• chainguard•lerna

  < 9.0.7-r11

• chainguard•librechat

  < 0.8.7-r5

• chainguard•nextcloud-server-32

  < 32.0.12-r6

• chainguard•nextcloud-server-33

  < 33.0.6-r8

• chainguard•nextcloud-server-34

  < 34.0.2-r4

• chainguard•opensearch-dashboards-2

  < 2.19.6-r7

• chainguard•opensearch-dashboards-2-fips

  < 2.19.5-r21

• chainguard•opensearch-dashboards-3

  < 3.7.0-r11

• chainguard•opensearch-dashboards-3-fips

  < 3.7.0-r7

• chainguard•prism

  < 5.16.0-r1

• chainguard•redisinsight

  < 3.8.0-r1

• chainguard•semaphore

  < 2.18.29-r0

• chainguard•wazuh-dashboard

  < 4.14.6-r6

• chainguard•wazuh-dashboard-fips

  < 4.14.6-r6

Showing first 50 affected entries in server-rendered view.

References (11)

• https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g
• https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields
• https://ubuntu.com/security/CVE-2026-67314
• https://www.cve.org/CVERecord?id=CVE-2026-67314
• https://security-tracker.debian.org/tracker/CVE-2026-67314
• https://nvd.nist.gov/vuln/detail/CVE-2026-67314
• https://github.com/axios/axios/pull/11000
• https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
• https://github.com/axios/axios
• https://github.com/axios/axios/releases/tag/v1.18.0
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67314.json