RHSA-2026:16534HighCVSS 8.2

Red Hat Security Advisory: Kiali 2.4.16 for Red Hat OpenShift Service Mesh 3.0

Published
May 12, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-42035 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-32280 →CVE-2026-40895 →CVE-2026-42033 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:246c34d2e769f9f40e5879bf335ce7db614442ade7733d4ac52e10a48d280843_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7900ecb89c736738098e9b82dfad1b33bb1f9d719551d6cceccbfc4e9bd2103d_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:da98415ade1160e1c40070e3a590f3390d8f10ced09103c78b4a2b9a00743291_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:f9fa6147fd9f3d074b496b9dd32f66c04bf4acd0a423f733827d2745f8da89d3_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3a93ddd83e947c84318d290d41861e5c2286990468c499710ca8479fbb05065e_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3f3d407102b90e3ad1e54606df7b87b5bad6f07db851d78802fc60708dd41d97_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4a56e9549c509968af14b978a087be6dc8f2d556dcab4bd7e18b401a72e2ce70_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:e60c4d74202fbe7b58ac619bbbc9950d4466f9edb0f21ce1b63cec3b61d27e62_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Kiali 2.4.16 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)