Improper access control in axios - CVE-2026-42038

Vulnerability identifier: #VU127599

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42038

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in shouldBypassProxy() when processing URLs against no_proxy rules. A remote attacker can supply a URL using an IP alias instead of the hostname to disclose sensitive information.

In server-side environments, requests intended to bypass proxies can instead be routed through an attacker-controlled proxy. This can affect access to internal or cloud metadata services.

axios
Storage Sentinel Anomaly Scan Engine
IBM supplied MQ Advanced container images
Rational Developer for i
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
IBM Decision Optimization for Cloud Pak for Data

Install security update from vendor's website.

axios - addressed in versions 0.31.1, 1.15.1
Storage Sentinel Anomaly Scan Engine - update to 2.3.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.7
IBM Sterling Secure Proxy - addressed in versions 6.1.0.4 iFix01, 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Bitbucket Data Center - addressed in versions 9.4.19, 10.2.2, 10.3.1
Rational Developer for i - update to 9.9.0.4
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
Bamboo Data Center - addressed in versions 10.2.20, 12.1.8
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm
• https://github.com/advisories/GHSA-m7pr-hjqh-92cm

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center and Jira Service Management Server
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Rational Developer for i
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Sterling Secure Proxy