CVE-2025-62718 is a vulnerability in Axios, a widely used HTTP client, where improper hostname normalization during NO_PROXY evaluation allows attackers to bypass proxy restrictions. This can lead to SSRF attacks by routing requests to internal or loopback addresses through a proxy. The vulnerability's impact is limited by the need for specific conditions: attacker control over URLs in server-side Axios usage, presence of both HTTP_PROXY and NO_PROXY configurations, and a proxy positioned to intercept or act on the misdirected traffic. Red Hat OpenShift Service Mesh 3.1's Kiali component (version 2.11.9) includes fixes for this and other related security issues. The advisory references multiple CVEs and CWE identifiers related to input validation, prototype pollution, denial of service, and code execution vulnerabilities. Red Hat has published an official security advisory (RHSA-2026:8490) with detailed information and remediation guidance.

Successful exploitation of this vulnerability can allow an attacker to perform Server-Side Request Forgery (SSRF), potentially accessing sensitive internal or loopback services that should be protected. However, the impact is constrained by the requirement that the attacker must control or influence URLs passed to Axios in a server-side context, the application must have both HTTP_PROXY and NO_PROXY configured, and the proxy must be able to intercept or act on the rerouted traffic. There are no known exploits in the wild at this time.

Red Hat has released Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1, which includes fixes for CVE-2025-62718 and other vulnerabilities. Users should upgrade to this version to remediate the issue. Currently, no alternative mitigations meet Red Hat's criteria for ease of use, applicability, or stability. Administrators should follow Red Hat's official documentation and advisories for applying the update. Since this is not a cloud service, remediation is managed by the user applying the update.