This advisory covers security fixes in Kiali 2.11.12 for Red Hat OpenShift Service Mesh 3.1. It includes CVE-2026-32281, a denial of service vulnerability caused by inefficient certificate chain validation in Go's crypto/x509 package, and CVE-2026-9277, an arbitrary code execution vulnerability due to command injection from unescaped line terminators in the shell-quote library. These vulnerabilities affect the Kiali components used for service mesh observability and management. Red Hat rates the update as having a Moderate security impact and classifies the advisory severity as Important. The advisory does not explicitly list fixed versions beyond the release of Kiali 2.11.12, and no CVSS scores are provided. Users should consult the referenced Red Hat advisory for further details and remediation instructions.

The vulnerabilities include a denial of service via inefficient certificate chain validation which could disrupt service mesh observability functions, and an arbitrary code execution vulnerability through command injection that could allow an attacker to execute arbitrary commands on the affected system. These issues affect the Kiali components within Red Hat OpenShift Service Mesh 3.1, potentially compromising the integrity and availability of service mesh monitoring and management. The overall security impact is rated Moderate by Red Hat, with the advisory severity classified as Important.

Red Hat has released Kiali 2.11.12 for OpenShift Service Mesh 3.1 which addresses these vulnerabilities. Users should upgrade to this version as documented in the official Kiali 2.11.12 documentation and Red Hat advisory RHSA-2026:26077. No other temporary or alternative mitigations are indicated. Patch status is confirmed by the vendor advisory. Users should follow Red Hat's official guidance for applying the update.