{"id":"CVE-2026-67315","title":"axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules","summary":"axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured pr…","severity":"medium","cwe":["CWE-183","CWE-115"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67315.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67315"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510019"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67315"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315"},{"url":"https://access.redhat.com/errata/RHSA-2026:50826"},{"url":"https://access.redhat.com/errata/RHSA-2026:49714"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-02T07:18:01.899Z","epss":0.00455,"epssPercentile":0.39286,"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["migration_toolkit_for_applications 8","migration_toolkit_for_containers","multicluster_engine_for_kubernetes","network_observability_operator","openshift_pipelines","openshift_service_mesh 3","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","build_of_apicurio_registry 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_dev_spaces","openshift_virtualization 4","quay 3","satellite 6","trusted_profile_analyzer","self_service_automation_portal 2","hardened_images"],"patched":["hardened_images"],"cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvssSource":"vendor","slug":"CVE-2026-67315","body":"## Overview\n\naxios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:50826** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50826)\n- **RHSA-2026:49714** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49714)\n- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Applications 8, Migration Toolkit for Containers, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Pipelines, OpenShift Service Mesh 3, … · no fix planned: Migration Toolkit for Applications 8, Migration Toolkit for Containers, Multicluster Engine for Kubernetes, Network Observability Operator, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67315.json)","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218444,"id":"CVE-2026-67315","ts":1791533735546,"field":"cvss","old":null,"new":"5.8"},{"seq":218443,"id":"CVE-2026-67315","ts":1791533735546,"field":"severity","old":"none","new":"medium"}]}