RHSA-2026:5132HighCVSS 9.1

Red Hat Security Advisory: Kiali 1.73.28 for Red Hat OpenShift Service Mesh 2.6

Published
March 19, 2026
Last Modified
September 1, 2026

🔗 CVE IDs covered (3)

CVE-2025-61726 →CVE-2025-68121 →CVE-2026-27606 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5bccd71519ece8217238731eec2d8aea226b53403e111113e94086d0695a1619_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:708f623ecd4790488b9377dac0417ce9c99e52a350a5d387722608beb54d5a63_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:af899fd57742510613433c8d9dab94989f4c5c9f7f3631985e4e8296a5781ea2_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:c37bc564685eacc236f7e9a3df6a9b3f0c1ee4bcaa0ee52ec42df6a27e4e4339_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:5a8a46e92a178be088251e0dcb67612d16bafeee910af6bd55de82a4727daa02_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:6487d8be05cb57a356dd53769f93c84d0abb3729ce1b39041c4d02247ad8e771_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:6c91551425148cad302317d8aac839b04e95dc7ecdf02cb8bddf4aaa87dcd550_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:a51a1b8587c6d4d63ba802112dd8b4a79d87a8af8dbf5341a3e5e917cae437dd_s390x as a component of Red Hat OpenShift Service Mesh 2.6

✅ Remediation

See Kiali 1.73.28 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate the risk of arbitrary file writes and remote code execution, ensure that build processes utilizing the Rollup module bundler are executed within a strictly controlled and isolated environment, such as a container with minimal privileges. Restrict the file system permissions of the user or service account running Rollup to only the directories absolutely necessary for its operation. Additionally, rigorously validate all inputs, including CLI arguments, manual chunk aliases, and third-party plugins, to prevent the introduction of malicious path traversal sequences.

🔗 References (10)