RHSA-2026:8490CriticalCVSS 9.1

Red Hat Security Advisory: Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1

Published
April 16, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (8)

CVE-2026-34986 →CVE-2026-40175 →CVE-2025-62718 →CVE-2026-4800 →CVE-2026-25679 →CVE-2026-29063 →CVE-2026-29074 →CVE-2026-33186 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (12)