CVE-2026-44495

High

Advisory

Published 29 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.0; base score, highest
EPSS: 0.008; 56th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 293; of 17,781 indexed, latest versions
Container images: 291; deployed by those charts
Fix available: 1 of 1; affected package

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Carried by container images the latest versions of 293 of 17,781 indexed charts deploy, on 291 images.

Affected package	Affected versions	Fixed in	Images
axiosnpm	0.19.0, 0.19.2, 0.20.0, 0.21.1+54 more	0.31.1, 1.15.2	291

OSV records: GHSA-3g43-6gmg-66jw

Charts affected

293 by stars

Chart

Latest

Affected images

Radar Score

data-fairdata354-helm

1.1.2

6 of 12 See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/data-fair/data-fair :3	cc9498b64b5b	axios@1.6.5	1.15.2
ghcr.io/data-fair/metrics :0	a8d40779eeae	axios@0.21.4	0.31.1
ghcr.io/data-fair/notify :3	c739b74dabb0	axios@0.30.0	0.31.1
ghcr.io/data-fair/portals :1	8b621866ceb2	axios@0.30.3	0.31.1
ghcr.io/data-fair/processings :1	5a9216989707	axios@0.21.4	0.31.1
ghcr.io/data-fair/simple-directory :4	38a4f32fad82	axios@0.21.4	0.31.1

Open the chart page →

38,346

mastodondefault-gh

0.3.1

1 of 3 See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	axios@1.3.2	1.15.2

Open the chart page →

5,056

joplin-serverdjjudas21

5.5.8

1 of 1 See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
joplin/server :2.14.2-beta	b87564ef34e9	axios@0.25.0	0.31.1

Open the chart page →

3,925

enbuildenbuild

0.0.50

3 of 6 See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	axios@1.13.6	1.15.2
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	axios@1.9.0	1.15.2
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	axios@1.13.6	1.15.2

Open the chart page →

31,510

iobrokereugen

0.2.6

1 of 1 See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/buanet/iobroker :v9.1.2	ca7dc7362968	axios@0.26.1	0.31.1

Open the chart page →

11,458

recaptcha-v3-verifierf3k-tech

1.110.0

1 of 1 See more

recaptcha-v3-verifier f3k-tech 1.110.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
f3ktech/recaptcha-v3-verifier :1.1.0	48e78987cf91	axios@1.13.2	1.15.2

Open the chart page →

1,208

ranetogabisonfire

0.1.2

1 of 1 See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/raneto :version-0.16.6	ef768f3df5d0	axios@0.21.1	0.31.1

Open the chart page →

2,519

ghostgeek-cookbook

2.2.0

1 of 1 See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
library/ghost :4.37.0	767230c0f263	axios@0.21.4	0.31.1

Open the chart page →

4,260

homebridgegeek-cookbook

5.3.2

1 of 1 See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	axios@0.26.0	0.31.1

Open the chart page →

15,653

overseerrgeek-cookbook

5.4.2

1 of 1 See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/sct/overseerr :1.26.1	254d16af8f71	axios@0.21.1	0.31.1

Open the chart page →

3,444

recipesgeek-cookbook

6.6.2

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	axios@0.24.0	0.31.1

Open the chart page →

7,801

uptime-kumageek-cookbook

1.4.2

1 of 1 See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.17.1	a4eab252e5a2	axios@0.21.4	0.31.1

Open the chart page →

5,079

youtubedl-materialgeek-cookbook

4.4.2

1 of 1 See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
tzahi12345/youtubedl-material :4.2	3720b856bd2f	axios@0.21.1	0.31.1

Open the chart page →

4,410

zigbee2mqttgeek-cookbook

9.4.2

1 of 1 See more

zigbee2mqtt geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
koenkk/zigbee2mqtt :1.19.1	5f9129b1ffbc	axios@0.21.1	0.31.1

Open the chart page →

2,173

ghostfolioghostfolio

0.5.4

1 of 3 See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	axios@0.21.4	0.31.1

Open the chart page →

3,123

uptimekumahelm-l3st86

0.1.10

1 of 1 See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.23.13	96510915e6be	axios@0.21.4	0.31.1

Open the chart page →

4,196

elasticinseefrlab

2.2.0

1 of 2 See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
library/kibana :7.17.3	e2e2031c15be	axios@0.21.1	0.31.1

Open the chart page →

17,284

kenerkener

0.2.0

1 of 1 See more

5,228

dashykrzwiatrzyk

1.0.0

1 of 1 See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/lissy93/dashy :2.1.1	acb40032ad4b	axios@1.6.0	1.15.2

Open the chart page →

3,143

litlyxlitlyx

0.2.0

1 of 5 See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
litlyx/litlyx-consumer :latest	02225e77d316	axios@1.13.2	1.15.2

Open the chart page →

7,874

food-managermoreillon

0.5.0

1 of 2 See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
moreillon/food-manager :latest	e8fd856e593d	axios@1.7.7	1.15.2

Open the chart page →

13,738

open5gs-webuiopen5gs-webui

2.3.1

1 of 2 See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
gradiant/open5gs-webui :2.7.5	fbd10c017541	axios@0.27.2	0.31.1

Open the chart page →

5,300

open-api-discoveryopen-api-discovery

0.1.1

1 of 1 See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
lukasreining/open-api-schema-collector :0.1.0	50e021c42e33	axios@1.2.1	1.15.2

Open the chart page →

2,473

uptime-kumapascaliske

3.0.0

1 of 1 See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2-slim-rootless	9865163f92c1	axios@0.30.2	0.31.1

Open the chart page →

6,883

flamerlex

0.3.0

1 of 1 See more

2,449

rocketadminrocketadmin

1.0.42

1 of 1 See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
rocketadmin/rocketadmin :1.17.7	10955ef540b9	axios@1.15.1	1.15.2

Open the chart page →

5,482

kibanaromanow-helm-charts

1.7.1

1 of 1 See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
library/kibana :7.17.8	c5781ba340ef	axios@0.27.2	0.31.1

Open the chart page →

6,879

uptime-kumasb-helm-charts

0.4.0

1 of 1 See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2	4c364ef96aad	axios@0.30.2	0.31.1

Open the chart page →

38,107

stornxstornx

1.1.1

1 of 9 See more

11,574

unitycatalogunitycatalog

0.0.2

1 of 4 See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	axios@1.7.5	1.15.2

Open the chart page →

12,581

tdarrvhdirk

5.0.5

1 of 2 See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	axios@0.26.1	0.31.1

Open the chart page →

26,657

wikiwenerme

2.2.0

1 of 2 See more

3,833

wraftwraft

0.1.12

1 of 9 See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	axios@1.11.0	1.15.2

Open the chart page →

10,090

youtubedl-materialyoutubedl-material

0.0.1

1 of 1 See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
tzahi12345/youtubedl-material :latest	2f943d584711	axios@0.21.4	0.31.1

Open the chart page →

9,783

akto-source-code-analyserakto

0.1.5

1 of 3 See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	axios@1.7.4	1.15.2

Open the chart page →

4,880

apimap-developerapimap

1.4.1

1 of 1 See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
apimap/developer :v1.3.1	406d3858e20c	axios@0.27.2	0.31.1

Open the chart page →

2,353

apimap-portalapimap

2.4.0

1 of 1 See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
apimap/portal :v2.4.0	041a4790c65c	axios@0.27.2	0.31.1

Open the chart page →

2,396

platform-uiappscode

2026.9.11

1 of 1 See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/platform-ui :2.4.0	668ee2682eaf	axios@1.15.0	1.15.2

Open the chart page →

690

agenthttpmqttassist-iot-composite-services

1.0.0

1 of 1 See more

agenthttpmqtt assist-iot-composite-services 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/composite-services-manager_agent-http-mqtt :latest	16d21bc5e42e	axios@1.6.8	1.15.2

Open the chart page →

1,158

agentmqtthttpassist-iot-composite-services

1.0.0

1 of 1 See more

agentmqtthttp assist-iot-composite-services 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/composite-services-manager_agent-mqtt-http :latest	27d58b8911cd	axios@1.6.8	1.15.2

Open the chart page →

1,158

dltkvassist-iot-data-integrity-verification

0.2.0

1 of 9 See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/dlt_api :2.0.0	e36a8922fa0c	axios@1.6.5	1.15.2

Open the chart page →

77,706

dltflassist-iot-dlt-based-fl

0.2.0

1 of 9 See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/dlt_api :2.1.0	c8a170683be7	axios@1.6.5	1.15.2

Open the chart page →

77,706

fl-orchestrator-guiassist-iot-fl-orchestrator

0.1.0

1 of 3 See more

fl-orchestrator-gui assist-iot-fl-orchestrator 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/fl_orchestrator :api-latest	7473d77448e1	axios@0.19.2	0.31.1

Open the chart page →

9,369

monitoring-notifyingassist-iot-monitoring-notifying

0.1.0

1 of 1 See more

monitoring-notifying assist-iot-monitoring-notifying 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/monitoring_notifying :2.0.0	68324d0fa5bb	axios@1.6.5	1.15.2

Open the chart page →

1,677

multilink-clientassist-iot-multi-link-client-app

1.0.0

1 of 2 See more

multilink-client assist-iot-multi-link-client-app 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/multi-link_client :latest	cf048365d042	axios@1.3.6	1.15.2

Open the chart page →

1,446

openapiassist-iot-open-api-management

0.2.2

1 of 6 See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/open_api_frontend :1.0.1	f11d82defc70	axios@0.26.1	0.31.1

Open the chart page →

18,277

smartorchestratorassist-iot-smart-orchestrator

4.0.0

3 of 14 See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
assistiot/smart-orchestrator_cluster :latest	4f41e1defe99	axios@0.27.2	0.31.1
assistiot/smart-orchestrator_enabler :latest	89f37e88c871	axios@0.27.2	0.31.1
assistiot/smart-orchestrator_repository :latest	a8b8dbed04a4	axios@0.27.2	0.31.1

Open the chart page →

45,363

audiobookshelfbdclark-helm-charts

0.1.4

1 of 1 See more

audiobookshelf bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/advplyr/audiobookshelf :2.36.0	180acad33d69	axios@0.27.2	0.31.1

Open the chart page →

1,722

bluesky-pdsbear

0.4.208

1 of 1 See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
ghcr.io/bluesky-social/pds :0.4.208	637083d9369d	axios@1.13.5	1.15.2

Open the chart page →

2,136

mx-apibicarus-labs

0.1.0

1 of 4 See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-44495.

Container image	Digest	Package	Fixed in
bicarus/mx-api-service :1.0.2-hf1	dab88659ae3b	axios@0.21.4	0.31.1

Open the chart page →

4,455

Container images carrying it

291 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/data-fair/data-fair :3	cc9498b64b5b	axios@1.6.5	1.15.2	1
ghcr.io/data-fair/metrics :0	a8d40779eeae	axios@0.21.4	0.31.1	1
ghcr.io/data-fair/notify :3	c739b74dabb0	axios@0.30.0	0.31.1	1
ghcr.io/data-fair/portals :1	8b621866ceb2	axios@0.30.3	0.31.1	1
ghcr.io/data-fair/processings :1	5a9216989707	axios@0.21.4	0.31.1	1
ghcr.io/data-fair/simple-directory :4	38a4f32fad82	axios@0.21.4	0.31.1	1
ghcr.io/drewburr-labs/evobot :3.0.0	4ddbb244c82f	axios@0.21.4	0.31.1	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	axios@1.7.8	1.15.2	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	axios@1.12.0	1.15.2	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	axios@1.12.0	1.15.2	1
ghcr.io/hiteshnayak305/cors-proxy :1.2.0	e6ff0a131556	axios@1.12.2	1.15.2	1
ghcr.io/linuxserver/raneto :version-0.16.6	ef768f3df5d0	axios@0.21.1	0.31.1	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	axios@0.21.1	0.31.1	1
ghcr.io/m9sweeper/dash :1.6.0	2e27cdff8344	axios@1.6.5	1.15.2	1
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	axios@1.3.2	1.15.2	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	axios@1.8.2	1.15.2	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	axios@0.26.0	0.31.1	1
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	axios@1.8.3	1.15.2	1
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	axios@1.3.2	1.15.2	1
ghcr.io/rodg/nodecg-base :latest	31be4bf87070	axios@1.6.8	1.15.2	1
ghcr.io/sct/overseerr :1.26.1	254d16af8f71	axios@0.21.1	0.31.1	1
ghcr.io/sct/overseerr :1.35.0	6197516c9d7b	axios@1.3.4	1.15.2	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	axios@1.7.5	1.15.2	1
ghcr.io/seerr-team/seerr :v3.2.0	c4cbd5121236	axios@1.15.0	1.15.2	1
ghcr.io/wei-shaw/claude-relay-service :v1.1.292	398c34934453	axios@1.11.0	1.15.2	1
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	axios@1.8.4	1.15.2	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	axios@0.21.4	0.31.1	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	axios@0.21.4	0.31.1	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	axios@0.21.4	0.31.1	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	axios@0.26.1	0.31.1	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	axios@1.15.0	1.15.2	1
quay.io/ibmgaragecloud/slack-notifications :latest	041df93e2bac	axios@0.21.1	0.31.1	1
quay.io/mittwald/kube-mail :latest	04f1099241fc	axios@1.10.0	1.15.2	1
quay.io/netwarps/walletconnect-relay :v2.1.3-rc.1	5d90b9c193e0	axios@0.26.1	0.31.1	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	axios@1.1.3	1.15.2	1
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	axios@0.21.4	0.31.1	1
quay.io/soketi/soketi :1.6-16-debian	713223456cf1	axios@0.21.4	0.31.1	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	axios@1.11.0	1.15.2	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	axios@1.13.6	1.15.2	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	axios@1.9.0	1.15.2	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	axios@1.13.6	1.15.2	1