RHSA-2026:26079HighCVSS 8.1

Red Hat Security Advisory: Kiali 2.17.9 for Red Hat OpenShift Service Mesh 3.2

Published
June 15, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (2)

CVE-2026-9277 →CVE-2026-32281 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:053f62e9327d00cff42761b6329de9ad51aa991cb407ee93dfd264a119dcbedd_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2712fb5cb978d5670aa858a4bb6c9906d84913d7f8d7ea616ae90c531650bf84_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:6fa68ac996600468f6db141b2aae175fd74739def04b98b845733d172d3f484d_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:6fe037a6b9dbc97f43eca680b2b5a09fccfea561af01a82d1c55a53ce413a661_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:473a0b1d4381fe01222ed465cc311e6c7471322988d3f6a5efe9c884a3fbe008_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a55e8a19ef4ff99d5ddc68a92ce37373ccf1ff7d69bdcaffa07c8fe3bee5f3b5_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d2be1e36684ba72d0245a864f82274003b0b26d7dfcb80cee88d116f6c0cb3cd_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:dfdb0cd01be7092f7338444876e89d92979381b602a4b38c10980ac3c1213fb0_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2

✅ Remediation

See Kiali 2.17.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)