CVE-2026-42264VulnerabilityPublished 9 Jul 2026Updated 30 Oct 2026

Red Hat Security Advisory: Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3

Affects Red HatSource GCVE Database

Compare

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Red Hat currently does not provide a direct patch for this vulnerability in Axios within their product ecosystem. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of deployment and applicability. Users should upgrade to Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3, which addresses this issue. Monitoring Red Hat advisories for future patches or mitigations is recommended. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for tailored guidance.

Description

A prototype pollution vulnerability (CVE-2026-42264) exists in Axios, a widely used HTTP client library included in Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3. This flaw allows an attacker who has already compromised another component in the same environment to inject malicious properties into JavaScript core objects. Axios may then unknowingly use these manipulated properties in outbound HTTP requests, potentially leading to information disclosure and manipulation of network communications. Red Hat rates this vulnerability as Important and has released Kiali 2.22.7 addressing this issue. No direct patch for Axios within Red Hat products is currently available, and mitigation options are limited.

Impact

The vulnerability allows an attacker who has already compromised another component in the same environment to manipulate the JavaScript Object prototype, causing Axios to send manipulated HTTP requests. This can result in information disclosure and alteration of network communications, compromising data confidentiality and integrity. Exploitation depends on a prior prototype pollution attack, so it is not directly exploitable without that condition. Red Hat classifies the impact as Important with a high potential for confidentiality and integrity loss but no availability impact.

CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
OWASP Cheat Sheets
Mass Assignment (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
OWASP ASVS 4.0.3
V5.1.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 30 Oct 2026, 09:30 UTC

WeaknessesCWE-915

Technical details

References

Community reviews

Related threats