RHSA-2026:26077HighCVSS 8.1

Red Hat Security Advisory: Kiali 2.11.12 for Red Hat OpenShift Service Mesh 3.1

Published
June 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (2)

CVE-2026-32281 →CVE-2026-9277 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:626653a4f6e9c2c047cfb66d1bdd667e4fdf8fdc3d84c3fc06defb19fe976958_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:6d03aff1601a0380a8a8346ed8df9e032134d0ab4d6143ee93fd64e57971ee43_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7e59e57089fb732a2053dc8b5aa5d83c944bf5e720ee874dec579ecb8bbdc630_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:bf317da1aa106f4ad08eae11a822fd5d4c81c698ce939e12055a7d5f639b6432_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0dad7ea2d7bd1843dff0fbfbee9b6356a0d3356074966e2ad5eceb08a139ffae_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:2b86f08b8e454f2b44cf38bf92b0146100960db8c21bf0145594428b0547de08_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3dd39ad7ffcf143d82203f5de0cddb42834642dbcab56a27df78fbf1875d8039_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a3a6c4465595a52d7c9ec7acdde38dc655ae8aaf5af6925738da00ab2514dc6e_amd64 as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Kiali 2.11.12 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)