RHSA-2026:8491CriticalCVSS 9.1

Red Hat Security Advisory: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2

Published
April 16, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (8)

CVE-2026-4800 →CVE-2026-25679 →CVE-2026-29063 →CVE-2026-29074 →CVE-2026-33186 →CVE-2026-34986 →CVE-2026-40175 →CVE-2025-62718 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2

✅ Remediation

See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (12)