Status: UPDATED | Advisory ID: CVE-2026-40895
| CVE | CVE-2026-40895 |
| CVSS Score / Version | |
| Updated | 2026-11-03 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 3.3 | ||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | ||
| Red Hat | Red Hat OpenShift AI (RHOAI) | ||
| Red Hat | Red Hat OpenShift AI 2.25 | ||
| Red Hat | Red Hat Enterprise Linux 8 | ||
| Red Hat | Red Hat build of Apicurio Registry 3 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.17 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.18 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.19 | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.20 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.21 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.22 | ||
| Red Hat | Red Hat Quay 3.10 | ||
| Red Hat | Red Hat Quay 3.12 | ||
| Red Hat | Red Hat Quay 3.14 | ||
| Red Hat | Red Hat Quay 3.15 | ||
| Red Hat | Red Hat Quay 3.16 | ||
| Red Hat | Red Hat Quay 3.17 | ||
| Red Hat | Red Hat Quay 3.9 | ||
| Red Hat | Red Hat Ansible Automation Platform 2 | ||
| Red Hat | Red Hat Discovery 2 | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | ||
| Red Hat | Red Hat 3scale API Management Platform 2 | ||
| Red Hat | Red Hat Fuse 7 | ||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | ||
| Red Hat | Red Hat Ansible Automation Platform 2.5 | ||
| Red Hat | Migration Toolkit for Applications 8 | ||
| Red Hat | Self-service automation portal 2 | ||
| Red Hat | Cluster Observability Operator 1.5.0 | ||
| Red Hat | multicluster engine for Kubernetes 2.6 | ||
| Red Hat | multicluster engine for Kubernetes 2.8 | ||
| Red Hat | Network Observability (NETOBSERV) 1.11.0 | ||
| Red Hat | Red Hat Advanced Cluster Security 4.9 | ||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | ||
| Red Hat | Red Hat Developer Hub 1.8 | ||
| Red Hat | Red Hat Developer Hub 1.9 | ||
| Red Hat | Red Hat Migration Toolkit 1.8 | ||
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | ||
| Red Hat | OpenShift Pipelines | ||
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | ||
| Red Hat | Red Hat build of Apicurio Registry 2 | ||
| Red Hat | Red Hat Developer Hub | ||
| Red Hat | Cryostat 4 on RHEL 9 | ||
| Red Hat | multicluster engine for Kubernetes 2.1 | ||
| Red Hat | multicluster engine for Kubernetes 2.11 | ||
| Red Hat | multicluster engine for Kubernetes 2.9 | ||
| Red Hat | Red Hat Build of Podman Desktop | ||
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | ||
| Red Hat | Red Hat Connectivity Link 1 | ||
| Red Hat | Red Hat Migration Toolkit for Applications 8.1 | ||
| follow-redirects_project | follow-redirects | ||
| follow-redirects | follow-redirects |
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0. (NVD)
Monitor Red Hat, follow-redirects_project, and follow-redirects's web pages for any future patch releases. See vendor advisory link below.