StackRadarChart IndexLive demo

CVE-2026-44487

High

Advisory

Published 4 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 50th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 304; of 17,787 indexed, latest versions
Container images: 301; deployed by those charts
Fix available: 1 of 1; affected package

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Carried by container images the latest versions of 304 of 17,787 indexed charts deploy, on 301 images.

Affected package	Affected versions	Fixed in	Images
axiosnpm	0.15.3, 0.16.2, 0.18.0, 0.18.1+60 more	0.32.0, 1.16.0	301

OSV records: GHSA-p92q-9vqr-4j8v

Charts affected

304 by stars

Chart

Latest

Affected images

Radar Score

wikiwikijs

1 of 2 See more

5,472

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-44487.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	axios@1.8.3	1.16.0

Open the chart page →

6,323

workadventureworkadventure

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-44487.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	axios@1.3.5	1.16.0
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	axios@1.3.5	1.16.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	axios@1.3.5	1.16.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	axios@1.3.5	1.16.0

Open the chart page →

16,083

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-44487.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	axios@0.28.1	0.32.0

Open the chart page →

9,381

Container images carrying it

301 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	axios@0.16.2	0.32.0	1