Kiali 2.22.5, part of Red Hat OpenShift Service Mesh 3.3, contains several security vulnerabilities: CVE-2026-32281 involves a denial of service via inefficient certificate chain validation in Go's crypto/x509 package; CVE-2026-9277 involves arbitrary code execution through command injection due to unescaped line terminators in the shell-quote library; CVE-2026-44293 involves arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors in protobufjs. These vulnerabilities allow remote attackers to cause denial of service or execute arbitrary code. Red Hat has released security advisories and updates, including Kiali 2.4.18 for OpenShift Service Mesh 3.0, addressing these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions or arbitrary code execution within the affected Kiali components of Red Hat OpenShift Service Mesh. This impacts the confidentiality, integrity, and availability of the service mesh observability infrastructure, potentially allowing attackers to disrupt monitoring or execute unauthorized commands.

Red Hat has published security advisories (e.g., RHSA-2026:26080) and released updated versions such as Kiali 2.4.18 for OpenShift Service Mesh 3.0 that address these vulnerabilities. Users should apply the official updates and patches provided by Red Hat as documented in the advisory and product documentation. Patch status is confirmed by the vendor advisory. No additional mitigation steps beyond applying the vendor-provided fixes are indicated.