This advisory covers multiple security flaws in Kiali components used in Red Hat OpenShift Service Mesh and related products. Notable vulnerabilities include CVE-2026-12143, a CRLF injection in the form-data library that allows attackers to inject additional headers or multipart form fields by injecting carriage return, line feed, or double-quote characters into field names or filenames. This can lead to form field override and data integrity compromise, particularly in custom deployments that use untrusted input for multipart form fields. Other vulnerabilities include cross-site scripting via improper HTML escaping (CVE-2026-42338), privilege escalation due to incorrect Punycode processing (CVE-2026-39821), prototype pollution causing information disclosure and man-in-the-middle attacks (multiple CVEs), denial of service via request size limits and WebSocket memory exhaustion, and proxy bypass via IPv4-mapped IPv6 address non-normalization. Red Hat has released updated Kiali versions (e.g., 1.73.33 for OpenShift Service Mesh 2.6) that address these issues. The advisory notes that default deployments using fixed field names are not impacted by the CRLF injection vulnerability. The vulnerabilities affect multiple Red Hat products including OpenShift Service Mesh versions 2.6 through 3.3 and Red Hat Quay versions 3.1 through 3.12.

The vulnerabilities collectively allow attackers to perform cross-site scripting, privilege escalation, information disclosure, denial of service, proxy bypass, and form field override via CRLF injection. The CRLF injection vulnerability (CVE-2026-12143) can compromise data integrity by allowing injection of arbitrary headers or multipart parts in HTTP requests. Prototype pollution vulnerabilities can lead to information disclosure and man-in-the-middle attacks. Denial of service vulnerabilities can exhaust memory or bypass request size limits. The impact is rated high overall, with some vulnerabilities rated moderate depending on deployment specifics. No known exploits in the wild have been reported at this time.

Red Hat has released updated Kiali versions, such as Kiali 1.73.33 for OpenShift Service Mesh 2.6, which include fixes for these vulnerabilities. Users should upgrade to these fixed versions as documented in the Red Hat advisory. For the CRLF injection vulnerability in the form-data library, deployments that use fixed or trusted field names are not impacted. Custom integrations that forward multipart requests with attacker-controlled field names should implement strict input validation and sanitization to prevent injection of control characters (CR, LF, "). Monitoring vendor advisories and applying official patches is recommended to maintain security.