This advisory covers security fixes in Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1. The vulnerabilities include CVE-2026-32280 (Go denial of service in certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), and multiple Axios-related issues (CVE-2026-42033, CVE-2026-42035, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044) involving prototype pollution leading to HTTP transport hijacking, arbitrary header injection, denial of service, authentication bypass, NO_PROXY bypass, and JSON response tampering. Red Hat rates the overall security impact as critical. The advisory does not provide a CVSS score but references CVE pages for details. The vulnerabilities affect Kiali as packaged for Red Hat OpenShift Service Mesh 3.1 and are fixed in version 2.11.10.

The vulnerabilities collectively allow attackers to cause denial of service, disclose sensitive information, hijack HTTP transport, inject arbitrary HTTP headers, bypass authentication, and tamper with JSON responses. These issues can undermine the security and reliability of the service mesh observability component, potentially impacting monitoring and management of service mesh environments. The severity is rated high by Red Hat Product Security, with critical impact noted in the advisory.

A fixed version, Kiali 2.11.10, is available and should be deployed to remediate these vulnerabilities. Users should upgrade to this version as documented in the Red Hat OpenShift Service Mesh 3.1 Kiali operator documentation. No additional temporary mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.