RHSA-2026:8493CriticalCVSS 9.1

Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3

Published
April 16, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-33186 →CVE-2026-34986 →CVE-2026-40175 →CVE-2025-62718 →CVE-2026-4800 →CVE-2026-25679 →CVE-2026-29063 →CVE-2026-29074 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products14

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (12)