Red Hat Security Advisory: Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6
Kiali 1.73.27, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently Security Fix(es): * kiali-ossmc-rhel8: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639) * kiali-rhel8: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639) * kiali-rhel8: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
AI Analysis
Technical Summary
The advisory covers several security fixes for Red Hat Satellite 6.16.9 and associated components. Key vulnerabilities include CVE-2026-40192 (denial of service via decompression bomb in Pillow image processing), CVE-2026-32282 (symlink traversal in Root.Chmod), CVE-2026-33186 (authorization bypass in gRPC-Go due to HTTP/2 path validation), CVE-2026-25679 (incorrect parsing of IPv6 host literals), CVE-2025-61729 (denial of service via crafted certificate in golang), CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages), CVE-2026-32280 and CVE-2026-32281 (denial of service vulnerabilities in Go certificate chain building and validation). The cert-manager Operator for Red Hat OpenShift 1.18.1 is also addressed with important security updates. The advisory does not provide a CVSS score but classifies the severity as high. No exploits in the wild are known. The vendor advisory indicates that upgrades are available and provides guidance on applying them depending on the approval policy.
Potential Impact
The vulnerabilities could allow denial of service conditions via crafted inputs in image processing and cryptographic certificate handling, as well as potential authorization bypass in gRPC-Go components. Symlink traversal issues could lead to unintended file permission changes outside intended directories. These issues affect system stability and security posture but no known active exploitation has been reported. The cert-manager Operator vulnerabilities could impact certificate management within Kubernetes clusters on Red Hat OpenShift.
Mitigation Recommendations
Red Hat has released updated versions of the affected components, including Red Hat Satellite 6.16.9 and cert-manager Operator for Red Hat OpenShift 1.18.1. Users should apply these updates to remediate the vulnerabilities. For cert-manager Operator, if the installation approval policy is set to 'Automatic' (default), the upgrade will be applied automatically. If set to 'Manual', administrators must approve the upgrade manually. Prior to applying updates, ensure all previously released errata are applied. No additional mitigation steps are indicated by the vendor advisory.
Red Hat Security Advisory: Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6
Description
Kiali 1.73.27, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently Security Fix(es): * kiali-ossmc-rhel8: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639) * kiali-rhel8: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639) * kiali-rhel8: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers several security fixes for Red Hat Satellite 6.16.9 and associated components. Key vulnerabilities include CVE-2026-40192 (denial of service via decompression bomb in Pillow image processing), CVE-2026-32282 (symlink traversal in Root.Chmod), CVE-2026-33186 (authorization bypass in gRPC-Go due to HTTP/2 path validation), CVE-2026-25679 (incorrect parsing of IPv6 host literals), CVE-2025-61729 (denial of service via crafted certificate in golang), CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages), CVE-2026-32280 and CVE-2026-32281 (denial of service vulnerabilities in Go certificate chain building and validation). The cert-manager Operator for Red Hat OpenShift 1.18.1 is also addressed with important security updates. The advisory does not provide a CVSS score but classifies the severity as high. No exploits in the wild are known. The vendor advisory indicates that upgrades are available and provides guidance on applying them depending on the approval policy.
Potential Impact
The vulnerabilities could allow denial of service conditions via crafted inputs in image processing and cryptographic certificate handling, as well as potential authorization bypass in gRPC-Go components. Symlink traversal issues could lead to unintended file permission changes outside intended directories. These issues affect system stability and security posture but no known active exploitation has been reported. The cert-manager Operator vulnerabilities could impact certificate management within Kubernetes clusters on Red Hat OpenShift.
Mitigation Recommendations
Red Hat has released updated versions of the affected components, including Red Hat Satellite 6.16.9 and cert-manager Operator for Red Hat OpenShift 1.18.1. Users should apply these updates to remediate the vulnerabilities. For cert-manager Operator, if the installation approval policy is set to 'Automatic' (default), the upgrade will be applied automatically. If set to 'Manual', administrators must approve the upgrade manually. Prior to applying updates, ensure all previously released errata are applied. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3107
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-25639"]
- Cvss Version
- null
Threat ID: 6a160970e29bf47b50638281
Added to database: 05/26/2026, 20:58:24 UTC
Last enriched: 07/30/2026, 08:40:08 UTC
Last updated: 07/31/2026, 22:10:00 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.