Permissive List of Allowed Inputs in axios - CVE-2026-42042
Published: April 24, 2026
Vulnerability identifier: #VU127596
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42042
CWE-ID: CWE-183
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and bypass CSRF protections.
The vulnerability exists due to permissive list of allowed inputs in lib/helpers/resolveConfig.js when processing the withXSRFToken config property during browser requests. A remote attacker can pollute Object.prototype.withXSRFToken with a truthy non-boolean value or rely on a misconfigured truthy non-boolean value to disclose sensitive information and bypass CSRF protections.
User interaction is required, and the issue affects browser environments where the XSRF logic runs only when hasStandardBrowserEnv is true.
Affected software
axios
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
How to mitigate CVE-2026-42042
Install security update from vendor's website.
axios - addressed in versions 0.31.1, 1.15.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6