Kiali, a component of Red Hat OpenShift Service Mesh providing service mesh observability, is affected by multiple security vulnerabilities across versions 3.0 and 3.1. The issues include denial of service in Go certificate chain building (CVE-2026-32280), information disclosure via cross-domain redirects in the follow-redirects library (CVE-2026-40895), and several prototype pollution vulnerabilities in the Axios HTTP client library (CVE-2026-42033, CVE-2026-42035, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044). These vulnerabilities enable HTTP transport hijacking, arbitrary HTTP header injection, NO_PROXY bypass, authentication bypass, denial of service via unbounded recursion, and invisible JSON response tampering. Red Hat has issued security advisories RHSA-2026:16532 and RHSA-2026:16534 with updated Kiali RPM packages (versions 2.11.10 and 2.4.16 respectively) to fix these vulnerabilities. The advisories classify the impact as critical and provide references for further details.

The vulnerabilities collectively pose a critical security risk to Red Hat OpenShift Service Mesh deployments using affected Kiali versions. They can lead to denial of service, unauthorized HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, information disclosure, and tampering with JSON responses. These issues undermine the security and integrity of service mesh observability and management functions, potentially affecting monitoring, tracing, and control of service mesh traffic. No known exploits in the wild have been reported, but the critical rating indicates a high potential impact if exploited.

Red Hat has released updated Kiali versions 2.11.10 for OpenShift Service Mesh 3.1 and 2.4.16 for 3.0 that address these vulnerabilities. Users should apply these updates promptly by deploying the provided RPM packages as detailed in the Red Hat advisories RHSA-2026:16532 and RHSA-2026:16534. The advisories provide documentation and container image references for the updated Kiali components. No additional mitigation steps are indicated beyond applying these official fixes.