RHSA-2026:26090HighCVSS 8.1

Red Hat Security Advisory: Kiali 2.22.5 for Red Hat OpenShift Service Mesh 3.3

Published
June 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (3)

CVE-2026-44293 →CVE-2026-9277 →CVE-2026-32281 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-44293 — protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors

🎯 Affected products14

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:2daadecfbd74f5117f1f201422e40873c3e282d4cfa7f68120b6cf20c0a25df5_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:26bfd90af1d7fb3787511dea26d5ea1368f07b145f85758d708bfa108abaec65_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8211925df422ecce0ba43f8aed2299cf3a2cc1b04c68be59972bfee210f5f094_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9504542a9e097ed2f7a2729883db5be8bbc9c8a5f776797bb0f4e145aee70ea3_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:cb4859594eb70bdbafb57c6559ef63ba5ad5f75661cf0863fe6f1c3e287326da_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8450f54ec40626dccf2d7e31ff964fbfd9cb603b208f50e640e72933d568ef3e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:be7aa341e43aed513489afd74dca73bd8470a9f49514792a74715bd198f6cb1d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:d1f1ee9cc09c530e5e795e2e7ababbc3c9b6b6c1412944a73537c1a7d5cdea76_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:f739d6238e0822edb906a9b21cab46e47799daa0ac4be96b6678de52a9ecc0a2_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0dbf34fe3dfa3ad05d3b4f0b31c6df5af681b6861dce5f1d5afda55172d624ef_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:20b191658314a61ccce8d4fd355f00c53e3899bb3d59eae1474105c012ddff8d_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:78d18c9e3add33c1d107c362ed7b5f8fd7662b69ae8b53ec2010584c25738746_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:b424872f6a729439b1e01bc874496b91b9eedd9241186f2259592a0e4a215614_arm64 as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Kiali 2.22.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)