Kiali 2.17.9 for Red Hat OpenShift Service Mesh 3.2 fixes two main security issues: CVE-2026-32281 is a denial of service vulnerability in Go's crypto/x509 package where inefficient validation of certificate chains containing many policy mappings can cause excessive resource consumption, potentially leading to service disruption. Exploitation requires a specially crafted certificate chain trusted by the system. CVE-2026-9277 is an arbitrary code execution vulnerability due to command injection caused by unescaped line terminators in the shell-quote package used in Kiali. This allows an attacker to execute arbitrary commands if they can influence input to the vulnerable shell-quote usage. Red Hat has rated the overall impact as moderate to high but has not yet provided an official patch for these vulnerabilities in the affected Kiali version. The advisory references updated images and documentation for mitigation and monitoring.

CVE-2026-32281 can lead to denial of service by causing excessive CPU and memory consumption during certificate chain validation, potentially degrading or disrupting service availability. Exploitation requires a trusted but maliciously crafted certificate chain, implying the attacker must have compromised a trusted certificate authority or root. CVE-2026-9277 allows arbitrary code execution via command injection due to improper escaping of line terminators, which could enable an attacker to execute commands on the affected system, potentially leading to full system compromise. Both vulnerabilities pose significant risks to the confidentiality, integrity, and availability of systems running the affected Kiali version within Red Hat OpenShift Service Mesh 3.2.

Red Hat has not released an official fix for these vulnerabilities in Kiali 2.17.9 as of the advisory date. Users should follow Red Hat's guidance by consulting the Kiali 2.17.9 documentation and Red Hat OpenShift Service Mesh advisories for any updates or recommended mitigations. Since no patch is currently available, monitoring for updates and applying them promptly when released is critical. Additionally, restricting access to trusted certificate authorities and carefully validating inputs that may reach shell-quote processing can reduce exposure. Customers with Red Hat Technical Account Managers (TAM) should engage them for tailored advice. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.