Red Hat Security Advisory: Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1
Red Hat OpenShift Service Mesh 3. 1's Kiali component version 2. 11. 10 addresses multiple security vulnerabilities including denial of service, information disclosure, HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, and JSON response tampering. These issues stem from flaws in dependencies such as Go certificate chain building, follow-redirects, and Axios HTTP client, particularly involving prototype pollution and crafted URLs. The update is rated with a high security impact by Red Hat Product Security. No known exploits in the wild have been reported. The advisory provides updated RPM packages for remediation.
AI Analysis
Technical Summary
Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1 fixes eight security vulnerabilities: CVE-2026-32280 (Go denial of service in certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), and six Axios-related issues (CVE-2026-42033, CVE-2026-42035, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044) involving prototype pollution leading to HTTP transport hijacking, arbitrary header injection, denial of service, authentication bypass, NO_PROXY bypass, and invisible JSON response tampering. These vulnerabilities affect the observability component of the service mesh, which visualizes mesh topology and metrics. Red Hat has released updated RPM packages for Kiali 2.11.10 to address these issues.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions, disclose sensitive information, hijack HTTP transport, inject arbitrary HTTP headers, bypass authentication, and tamper with JSON responses within the Kiali component of Red Hat OpenShift Service Mesh 3.1. This may impact the reliability and security of service mesh observability and management. However, no known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released Kiali version 2.11.10 for OpenShift Service Mesh 3.1 containing fixes for these vulnerabilities. Users should update to this version by applying the updated RPM packages provided by Red Hat. Refer to the official Red Hat advisory RHSA-2026:16532 and Kiali 2.11.10 documentation for detailed upgrade instructions. Since this is not a cloud service, remediation requires user action to update the component. Patch status is confirmed by the vendor advisory.
Red Hat Security Advisory: Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1
Description
Red Hat OpenShift Service Mesh 3. 1's Kiali component version 2. 11. 10 addresses multiple security vulnerabilities including denial of service, information disclosure, HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, and JSON response tampering. These issues stem from flaws in dependencies such as Go certificate chain building, follow-redirects, and Axios HTTP client, particularly involving prototype pollution and crafted URLs. The update is rated with a high security impact by Red Hat Product Security. No known exploits in the wild have been reported. The advisory provides updated RPM packages for remediation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1 fixes eight security vulnerabilities: CVE-2026-32280 (Go denial of service in certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), and six Axios-related issues (CVE-2026-42033, CVE-2026-42035, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044) involving prototype pollution leading to HTTP transport hijacking, arbitrary header injection, denial of service, authentication bypass, NO_PROXY bypass, and invisible JSON response tampering. These vulnerabilities affect the observability component of the service mesh, which visualizes mesh topology and metrics. Red Hat has released updated RPM packages for Kiali 2.11.10 to address these issues.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions, disclose sensitive information, hijack HTTP transport, inject arbitrary HTTP headers, bypass authentication, and tamper with JSON responses within the Kiali component of Red Hat OpenShift Service Mesh 3.1. This may impact the reliability and security of service mesh observability and management. However, no known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released Kiali version 2.11.10 for OpenShift Service Mesh 3.1 containing fixes for these vulnerabilities. Users should update to this version by applying the updated RPM packages provided by Red Hat. Refer to the official Red Hat advisory RHSA-2026:16532 and Kiali 2.11.10 documentation for detailed upgrade instructions. Since this is not a cloud service, remediation requires user action to update the component. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:16532
- Cve Count
- 8
- Additional Cves
- ["CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]
- Cvss Version
- null
Threat ID: 6a160974e29bf47b5063e7b6
Added to database: 5/26/2026, 8:58:28 PM
Last enriched: 5/26/2026, 10:06:26 PM
Last updated: 5/26/2026, 10:26:47 PM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.