RHSA-2026:16542HighCVSS 8.2

Red Hat Security Advisory: Kiali 2.22.3 for Red Hat OpenShift Service Mesh 3.3

Published
May 12, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-32280 →CVE-2026-40895 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products14

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f2a866a31810c6bc52d68ab3d5d3f8dd44ccf998a6453f658835927eedd33297_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4fcc3d48a763c1cc51b2cd253a4862c7bf99cd614163ef2f80d5a2f8968066a1_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a2653de5f3faf7d7841393935e7ac5854dcb142c6dcf4342bd3780ca0a2c49a7_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a8aa325e131bbf968e1d1d73703a127c442748633b0cf3122dc4589ee166bb45_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e19802cc2f5e1bbbd60343303fbd0c0ac2f35e45da3911f2e0b379e5eed437ff_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84019963d8034b33331e015389e8c76b4c58ffe83fb6613b548af3218b4b7ffc_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a1e557b983f7579cb3a402bfae03e9015c176240842ac51d67a83f301b77b4fd_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a85ccd92fc8328805bce9266f3b7356406bff3583d20c9f0307e2f32d8134efc_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:dddf652e126cf6c782f64b4999dd560c93e4877f89e7c5b20cbedd75ff468f26_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:090606c29b60475f35670aaa1147e584eb8533c0506ec81a96fae7fcbe3187c1_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:78f6df0632a9a6bf00ee1b60447d24ba2e5d7c2114e410380b7344201bc4fc5b_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:aba022fa90760e6af6aeb71ef239682e874a53128744ca6f1a44781d3b82a56f_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d39dd709dbe62218720d56bda7c8c2441f9dc3b2acfae27307b50b86c16a866e_s390x as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Kiali 2.22.3 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)