RHSA-2026:8484CriticalCVSS 9.1

Red Hat Security Advisory: Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0

Published
April 16, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (7)

CVE-2026-33186 →CVE-2026-40175 →CVE-2025-62718 →CVE-2026-4800 →CVE-2026-25679 →CVE-2026-29063 →CVE-2026-29074 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (11)