RHSA-2026:59561 - Security Advisory

Topic

Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1 is now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kiali 2.11.16, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.

Security Fix(es):

• CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15106)
• CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15111)
• CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15118)
• CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15119)
• CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15156)
• CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15162)
• CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15171)
• CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15172)
• CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15182)
• CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15183)
• CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15193)
• CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15223)
• CVE-2026-45149 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15261)
• CVE-2026-45149 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15266)
• CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15288)
• CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15289)
• CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15307)
• CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15308)
• CVE-2026-56852 openshift-service-mesh/kiali-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (OSSM-15324)
• CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15401)
• CVE-2026-56859 openshift-service-mesh/kiali-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15406)
• CVE-2026-56853 openshift-service-mesh/kiali-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15420)
• CVE-2026-56858 openshift-service-mesh/kiali-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15434)
• CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15444)
• CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15453)
• CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15475)
• CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15477)
• CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15486)
• CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15487)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

See Kiali 2.11.16 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat

Affected Products

• Red Hat OpenShift Service Mesh

Fixes

CVEs

• CVE-2026-14257
• CVE-2026-33818
• CVE-2026-45149
• CVE-2026-45623
• CVE-2026-54272
• CVE-2026-56852
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-67313
• CVE-2026-67320
• CVE-2026-69152
• CVE-2026-69153
• CVE-2026-69192
• CVE-2026-73088
• CVE-2026-73089

References

• https://access.redhat.com/security/updates/classification
• https://access.redhat.com/security/updates/classification/