RHSA-2026:16476HighCVSS 8.2

Red Hat Security Advisory: Kiali 1.73.30 for Red Hat OpenShift Service Mesh 2.6

Published
May 12, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-40895 →CVE-2026-41240 →CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-32280 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-41240 — DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:251acc1dcd2446bff4a6ea247e991c3c9186be784ac604df10efec1b312a8c87_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:36984ea16e6a9bf9eaac871eb2ed4be536fa95ecaac021e95a0be3a3c4e3af5d_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:71f6f8597af2b563219bfd8bd15f159433636edb2496c785a82535c8b8d8b70e_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b1ac1a78df89243431ff25c249b17d06487ca0bb5c77936d3f12f1d75f070757_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:40547afa883b9173c85f0498a1bd7107be4ad7d0bd753422286b9e1e35cfd20f_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:588bf79e80f6713af9766978eb4287fb691351f8e11285cfa00161553102a099_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7aa34d481670c9470c3cd5f07319d30bbed5e4d8d8a0abeacb8ff8919bb88884_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:bbe2a362c9c494ad0e9c7549136447a38c31312c49f9f528c75bc5f1ef5bb1a2_amd64 as a component of Red Hat OpenShift Service Mesh 2.6

✅ Remediation

See Kiali 1.73.30 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)