Kiali 2.4.16, used in Red Hat OpenShift Service Mesh 3.0, fixes several security vulnerabilities. Notably, CVE-2026-32280 is a denial of service vulnerability in the Go standard library's crypto/x509 and crypto/tls packages caused by unbounded processing of excessive intermediate certificates during certificate chain building, leading to resource exhaustion. Additional vulnerabilities in the Axios HTTP client include prototype pollution leading to HTTP transport hijacking, arbitrary HTTP header injection, NO_PROXY bypass, denial of service via unbounded recursion, authentication bypass, and JSON response tampering. These issues collectively pose risks of service unavailability and information disclosure. Red Hat has released Kiali 2.4.16 to address these flaws.

The primary impact is denial of service due to resource exhaustion in the Go certificate chain building process when handling untrusted TLS certificates. Other impacts include information disclosure through cross-domain redirects, HTTP transport hijacking, arbitrary HTTP header injection, bypass of NO_PROXY settings, authentication bypass, and invisible JSON response tampering via prototype pollution in Axios. These vulnerabilities can disrupt service availability and compromise data confidentiality and integrity in affected deployments.

Red Hat has released Kiali version 2.4.16 for OpenShift Service Mesh 3.0 that addresses these vulnerabilities. Users should upgrade to this fixed version to remediate the issues. No additional mitigations are specified by Red Hat. Patch status is confirmed as fixed in version 2.4.16. Refer to the official Red Hat advisory RHSA-2026:16534 for detailed update instructions.