CVE-2026-67315
Aliases:UBUNTU-CVE-2026-67315DEBIAN-CVE-2026-67315GHSA-f4gw-2p7v-4548CGA-44hq-639q-6r87CGA-45q7-mcqq-rqrgCGA-5jf4-gfv8-mhv6CGA-5mc2-p2v2-w235CGA-5mp6-9xg2-x559CGA-5qxm-vrcp-2xjqCGA-73q3-5q4c-wv7hCGA-7ch6-v7g4-g9hwCGA-83p4-mrq4-c6c3CGA-8ghw-8w3r-33q3CGA-8rrh-vq5m-qwxhCGA-8wxh-2cg3-m8v7CGA-9pw7-gqxj-j239CGA-9px4-6254-g8g8CGA-cc9f-vrx4-5gf2CGA-cgwj-xwpc-v73gCGA-gc6j-ghqg-mh89CGA-gf7v-vpwh-xpp9CGA-h6pp-96xc-42x7CGA-j82v-7fcx-xjr3CGA-24r8-wp73-c7q8CGA-2869-58hr-qrf7CGA-2q48-5c35-c6gpCGA-34xc-h32c-cpxhCGA-35vp-hqwj-x96jCGA-363g-3mcx-572fCGA-37fc-796f-r4cqCGA-37jg-6jv3-25ggCGA-3cq7-pw29-hp43CGA-3h89-fh4c-j942CGA-3r3f-g77q-cx2wCGA-453v-29c9-624gCGA-45gw-w4p2-7325CGA-4993-rvgx-w5vhCGA-49mf-9q9x-j6f6CGA-4j87-2mf2-qv2pCGA-4mch-hh44-pq7hCGA-4qg7-hqqv-wxxmCGA-4xww-q37w-g69wCGA-54hx-8rpw-rjcmCGA-5pmm-33xh-cxrpCGA-5pqh-gj37-327mCGA-5vpq-r7v8-4hghCGA-5x2f-hpmc-9c33CGA-624c-2pg9-724cCGA-6348-m257-xhccCGA-635p-wjcg-r3h5CGA-64qf-qm5f-7qq5CGA-652m-ww67-64gqCGA-6533-q5xc-gw56CGA-6666-w6q4-75j4CGA-66x8-r64f-8c84CGA-6p2m-q8vr-263wCGA-6p5m-x5vc-8j2vCGA-6vg7-jqxf-j39hCGA-7297-2f4h-g9wmCGA-72h6-xccg-qwv4CGA-76f5-g4rx-8vj7CGA-76x5-vr48-55mxCGA-7g66-8jv4-fpj9CGA-7hrc-3mhh-vwmqCGA-7vjh-cmpv-8r4rCGA-8f88-5prp-gwfxCGA-8fj6-p39w-h9jmCGA-8mfh-3c7p-qvh5CGA-8xpv-86f4-4rq5CGA-92r7-2v66-xfh6CGA-94p8-mrf2-vmq6CGA-98p3-78f2-xfxqCGA-9hwj-5gj8-7gp2CGA-9m6f-9386-374xCGA-9r66-wpjf-rfv5CGA-ccvr-ghfp-9365CGA-fgx6-4mq6-qw34CGA-fh99-27hm-8pg3CGA-frm9-5hh3-g6g8CGA-fxhr-74f6-26g9CGA-gg9v-56wv-4g7mCGA-gm4c-h4xc-pgc4CGA-gw72-6gx2-cjr6CGA-gwhc-89p5-9fwmCGA-hj3x-9vfq-rqpwCGA-hjwv-q6mp-rwwqCGA-j26g-x5qg-p64cCGA-j4r4-f585-8x8pCGA-j7gv-gfm5-phfpCGA-j88g-xmjm-9pprCGA-jcm6-j4qm-9fxfCGA-jggc-gcvv-jpm2CGA-jmv5-g272-4xqxCGA-jq94-px3c-994rCGA-jqhm-q44r-hf63CGA-m4rg-9pv3-cfq4CGA-m5jc-pjhh-3643CGA-mfrf-q48w-3h7hCGA-mg4r-h44x-fhm4CGA-p2cj-5mhv-jxmcCGA-p345-ffq4-9rpxCGA-p5mr-vw34-hhwpCGA-p7c2-3wj6-w4mqCGA-pfgj-rrxw-p5gxCGA-pfhj-pwv4-mp88CGA-pmxm-3w6v-gcrvCGA-pwcr-76xg-85cpCGA-qg8f-85q3-mppcCGA-qrf5-6g62-mj9vCGA-qwqw-rfvw-fxjwCGA-r2pj-qpjv-w73qCGA-r75w-g7rg-mwxjCGA-r8v3-rcpm-vgwhCGA-r976-37vw-2grgCGA-rgjx-p3ww-pq7wCGA-rhq3-gg83-x3j4CGA-rj6x-hcqx-2vwmCGA-rmfg-cc2m-hx2cCGA-rqx8-v7p5-pw5vCGA-vcfr-pgq3-f6vqCGA-vg85-fjx6-9pfmCGA-vh3j-26c2-jqc4CGA-vm87-9gjv-444vCGA-vm8m-3qvm-hmx8CGA-vw2x-f6m3-xjjhCGA-vwgm-mq47-9w5qCGA-w3cg-2pwg-375cCGA-w9pg-pxmf-v38fCGA-x254-c6r6-2w2pCGA-x45q-jhh6-6hfvCGA-x45x-5gpm-xg4cCGA-x765-64gv-2fvvCGA-xcg4-fcgj-hq3rCGA-xq8q-38jc-fx3jCGA-xrf9-xfvv-jx8pCGA-xvf3-wvrj-3x4mCGA-xw7c-9xf6-gqxcCGA-xw94-cchf-gwv7CGA-48vr-jr6c-pcc8
Advisory lineage Upstream: 2 Downstream: 3
Analyzed
Published: 01 Aug 2026, 12:22
Last modified:03 Aug 2026, 15:37
Vulnerability Summary
Overall Risk (default)
medium
40/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.33% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
01 Aug 2026, 12:22
Published
Vulnerability first disclosed
03 Aug 2026, 15:37
Last Modified
Vulnerability information updated
Description
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
CVSS Metrics
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.33%• Percentile: 26%
Techniques & Countermeasures
- CWE-183•Permissive List of Allowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Affected Systems
- chainguard•awx
< 24.6.1-r45
- chainguard•azurite
< 3.35.0-r2
- chainguard•gitlab-rails-ce-18.1
all
- chainguard•gitlab-rails-ce-19.0
all
- chainguard•gitlab-rails-ce-19.1
all | < 19.1.7-r6
- chainguard•gitlab-rails-ce-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-19.3
< 19.3.1-r6
- chainguard•gitlab-rails-ce-fips-19.0
all
- chainguard•gitlab-rails-ce-fips-19.1
all | < 19.1.7-r7
- chainguard•gitlab-rails-ce-fips-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-fips-19.3
< 19.3.1-r3
- chainguard•jitsucom-jitsu-console
< 2.11.0-r30
- chainguard•kibana-8.17
< 8.17.10-r31
- chainguard•kibana-8.17-bitnami
< 8.17.10-r31
- chainguard•kibana-8.17-iamguarded
< 8.17.10-r31
- chainguard•kibana-8.19
< 8.19.18-r2
- chainguard•kibana-8.19-bitnami
< 8.19.18-r2
- chainguard•kibana-8.19-iamguarded
< 8.19.18-r2
- chainguard•kibana-9.0
< 9.0.8-r34
- chainguard•kibana-9.0-bitnami
< 9.0.8-r34
- chainguard•kibana-9.0-iamguarded
< 9.0.8-r34
- chainguard•kibana-9.1
< 9.1.10-r30
- chainguard•kibana-9.1-iamguarded
< 9.1.10-r30
- chainguard•kibana-9.2
< 9.2.8-r18
- chainguard•kibana-9.2-iamguarded
< 9.2.8-r18
- chainguard•kibana-9.3
< 9.3.8-r1
- chainguard•kibana-9.3-iamguarded
< 9.3.8-r1
- chainguard•kibana-9.4
< 9.4.4-r3
- chainguard•kibana-9.4-iamguarded
< 9.4.4-r3
- chainguard•kubeflow-centraldashboard
< 1.10.0-r26
- chainguard•langfuse-2
< 2.95.12-r35
- chainguard•langfuse-2-worker
< 2.95.12-r35
- chainguard•langfuse-3
< 3.223.0-r0
- chainguard•langfuse-3-compat
< 3.225.7-r6
- chainguard•langfuse-3-worker
< 3.223.0-r0
- chainguard•langfuse-fips-2
< 2.95.12-r38
- chainguard•langfuse-fips-2-worker
< 2.95.12-r38
- chainguard•langfuse-fips-3
< 3.223.0-r0
- chainguard•langfuse-fips-3-worker
< 3.223.0-r0
- chainguard•lerna
< 9.0.7-r11
- chainguard•librechat
< 0.8.7-r5
- chainguard•nextcloud-server-32
< 32.0.12-r6
- chainguard•nextcloud-server-33
< 33.0.6-r8
- chainguard•nextcloud-server-34
< 34.0.2-r4
- chainguard•opensearch-dashboards-2
< 2.19.6-r7
- chainguard•opensearch-dashboards-2-fips
< 2.19.5-r21
- chainguard•opensearch-dashboards-3
< 3.7.0-r11
- chainguard•opensearch-dashboards-3-fips
< 3.7.0-r7
- chainguard•prism
< 5.16.0-r1
- chainguard•redisinsight
< 3.8.0-r1
Showing first 50 affected entries in server-rendered view.
References (15)
- https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548
- https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via
- https://ubuntu.com/security/CVE-2026-67315
- https://www.cve.org/CVERecord?id=CVE-2026-67315
- https://security-tracker.debian.org/tracker/CVE-2026-67315
- https://github.com/axios/axios/pull/11000
- https://github.com/axios/axios/pull/11001
- https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
- https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67315
- https://nvd.nist.gov/vuln/detail/CVE-2026-68946
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67315.json