RHSA-2026:26080HighCVSS 8.1

Red Hat Security Advisory: Kiali 2.4.18 for Red Hat OpenShift Service Mesh 3.0

Published
June 15, 2026
Last Modified
October 1, 2026

🔗 CVE IDs covered (2)

CVE-2026-9277 →CVE-2026-32281 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:251fd9c3bfe135b9a7544c97c4169b36183a3b8c4c3b2255b772359f00e932e9_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2f171572c72f05b82da40f74fd25cf479d693afb24477e15478d2b602b86bd16_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4b98893e9a829922e0444f70b0011d1a9c8af3a08d6e48f6c87d752657db1c68_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ac654a09e840d2e4d47ed77a70d29d5ca01d8d3fa8e8905b90cda4e4a77813f1_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:10a6ac2eebe2fbab2a2ab538687774d227dec3c4b87f4b283ac7fa1510b87288_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:2e2cde16b866b764d4191d0024b07f8517ee390fff35b4af0109356da7646495_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a54f200ca82613a7c4a58b99e7f1b1dc1b0c9462e0a457f7c1c28a878ec8b8b9_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cf6c0442d0aa7c3265a01f672723356aed640ad0a8ea4a197e106397e451fdb2_s390x as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Kiali 2.4.18 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)