This advisory covers Kiali 1.73.30 for Red Hat OpenShift Service Mesh 2.6, which fixes eight distinct vulnerabilities: CVE-2026-32280 (DoS in Go certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), CVE-2026-41240 (XSS via inconsistent tag sanitization in DOMPurify), and multiple Axios-related issues including HTTP transport hijacking (CVE-2026-42033), arbitrary HTTP header injection (CVE-2026-42035), denial of service via unbounded recursion (CVE-2026-42039), authentication bypass (CVE-2026-42041), and NO_PROXY bypass (CVE-2026-42043). These vulnerabilities impact the security posture of the service mesh observability tool by potentially allowing denial of service, information leakage, cross-site scripting, and authentication bypass attacks. The advisory does not provide CVSS scores but rates the overall impact as critical. The update also includes a migration from Yarn Classic to Yarn v4 or NPM for package management.

The vulnerabilities fixed in Kiali 1.73.30 can lead to denial of service conditions, information disclosure, cross-site scripting attacks, HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, and bypass of NO_PROXY protections. These issues could compromise the integrity, confidentiality, and availability of the service mesh observability component, potentially affecting monitoring and management of the service mesh environment.

A fixed version, Kiali 1.73.30 for Red Hat OpenShift Service Mesh 2.6, is available and should be deployed to remediate the listed vulnerabilities. Users should upgrade to this version following the official Red Hat documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x. No additional mitigations are specified or required beyond applying this update.