Search: CVE-2026-42033

Multiple critical security vulnerabilities have been identified in Kiali components used in Red Hat OpenShift Service Mesh versions 3.0 and 3.1. These vulnerabilities affect the Axios HTTP client, Go certificate chain building, and the follow-redirects library, leading to issues such as denial of service, HTTP transport hijacking, arbitrary HTTP header injection, authentication bypass, information disclosure, and JSON response tampering. Red Hat has released updated Kiali versions 2.4.16 for OpenShift Service Mesh 3.0 and 2.11.10 for OpenShift Service Mesh 3.1 that address these issues. The advisories provide RPM packages and documentation for remediation. No known exploits in the wild have been reported at this time.