Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1 fixes several security vulnerabilities. Notably, CVE-2026-32280 is a denial of service vulnerability in the Go standard library's crypto/x509 and crypto/tls packages caused by excessive intermediate certificates during certificate chain building, leading to resource exhaustion. Additional vulnerabilities involve the Axios HTTP client library, including prototype pollution that enables HTTP transport hijacking, arbitrary header injection, NO_PROXY bypass, denial of service via unbounded recursion, authentication bypass, and JSON response tampering. Another vulnerability involves information disclosure via cross-domain redirects in the follow-redirects package. Red Hat rates these issues as critical and provides updated container images and documentation for remediation.

The vulnerabilities can cause denial of service conditions by exhausting system resources during TLS certificate chain processing or HTTP request handling. Prototype pollution in Axios can lead to HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, and invisible JSON response tampering, potentially compromising the integrity and availability of affected services. Information disclosure via cross-domain redirects may expose sensitive data. These impacts affect systems running Kiali 2.11.10 in Red Hat OpenShift Service Mesh 3.1 environments.

A fixed version, Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1, is available and should be deployed to remediate these vulnerabilities. Users should update to this version following Red Hat's official documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat. No additional mitigations are specified by the vendor advisory. Red Hat Product Security rates this update as critical and recommends prompt application of the fix.