The advisory covers Kiali 2.17.7 for Red Hat OpenShift Service Mesh 3.2, which fixes several vulnerabilities: CVE-2026-32280 (Go denial of service in certificate chain building), CVE-2026-40895 (information disclosure via cross-domain redirects in follow-redirects), and multiple Axios-related vulnerabilities including HTTP transport hijacking, arbitrary HTTP header injection, NO_PROXY bypass, denial of service via unbounded recursion, authentication bypass, and JSON response tampering via prototype pollution. The Axios NO_PROXY bypass (CVE-2025-62718) allows potential SSRF attacks under specific conditions. Red Hat rates the overall impact as critical and provides updated container images. The vulnerabilities stem from improper input validation, prototype pollution, and hostname normalization issues in third-party libraries used by Kiali.

Successful exploitation of these vulnerabilities could lead to denial of service conditions, information disclosure, HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, and server-side request forgery (SSRF) in environments running Kiali 2.17.7 on Red Hat OpenShift Service Mesh 3.2. This could degrade service mesh observability and management, potentially exposing sensitive internal services or disrupting service mesh operations. The Axios NO_PROXY bypass requires specific proxy configurations and attacker control over URLs to exploit. Red Hat rates the security impact as critical.

A fixed version, Kiali 2.17.7 for Red Hat OpenShift Service Mesh 3.2, is available and should be deployed to remediate these vulnerabilities. Users should update to this version following Red Hat's official documentation. No alternative mitigations are noted in the advisory. Red Hat provides updated container images for multiple architectures. Users should consult the Red Hat advisory RHSA-2026:16535 for detailed update instructions.