Kiali versions 2.4.16 (for OpenShift Service Mesh 3.0) and 2.11.10 (for OpenShift Service Mesh 3.1) fix multiple critical vulnerabilities including CVE-2026-32280 (Go denial of service in certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), and several Axios-related issues (CVE-2026-42033, CVE-2026-42035, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044) involving prototype pollution leading to HTTP transport hijacking, arbitrary HTTP header injection, denial of service, authentication bypass, NO_PROXY bypass, and JSON response tampering. These vulnerabilities impact the observability component of the service mesh, potentially undermining security controls and data confidentiality. Red Hat has rated the security impact as Critical and published advisories with updated packages and documentation for remediation.

The vulnerabilities collectively allow attackers to cause denial of service conditions, hijack HTTP transport, inject arbitrary HTTP headers, bypass authentication, disclose information via cross-domain redirects, and tamper with JSON responses. This can compromise the integrity, confidentiality, and availability of the Kiali observability component within Red Hat OpenShift Service Mesh, potentially affecting monitoring and management of service mesh environments.

Red Hat has released updated Kiali versions 2.4.16 for OpenShift Service Mesh 3.0 and 2.11.10 for OpenShift Service Mesh 3.1 that address these vulnerabilities. Users should apply these updates promptly by following the official Red Hat documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat and https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat. No additional mitigation steps are indicated beyond applying the official patches.