Improper access control in axios - CVE-2026-42038

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127599

Improper access control in axios - CVE-2026-42038

Published: April 24, 2026 / Updated: June 19, 2026


Vulnerability identifier: #VU127599
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42038
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in shouldBypassProxy() when processing URLs against no_proxy rules. A remote attacker can supply a URL using an IP alias instead of the hostname to disclose sensitive information.

In server-side environments, requests intended to bypass proxies can instead be routed through an attacker-controlled proxy. This can affect access to internal or cloud metadata services.


Affected software

axios
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images

How to mitigate CVE-2026-42038

Install security update from vendor's website.

axios - addressed in versions 0.31.1, 1.15.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.7
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Bitbucket Data Center - addressed in versions 9.4.19, 10.2.2, 10.3.1
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
Bamboo Data Center - addressed in versions 10.2.20, 12.1.8
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

External References

Related Security Bulletins