Red Hat Product Errata RHSA-2026:9440 - Security Advisory
Issued:
2026-04-21
Updated:
2026-04-21

RHSA-2026:9440 - Security Advisory

Synopsis

Red Hat OpenShift Service Mesh 3.0.10

Type/Severity

Security Advisory: Important

Topic

Red Hat OpenShift Service Mesh 3.0.10

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 3.0.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Fixes/Improvements:

Security Fix(es):

  • istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  • istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  • istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  • istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  • istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
  • istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
  • istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)

Solution

See Red Hat OpenShift Service Mesh 3.0.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0

Fixes

amd64

registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d
registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c
registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca
registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f
registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9
registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802
registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8

arm64

registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74
registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47
registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b
registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc
registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb
registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f

ppc64le

registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86
registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc
registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493
registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d
registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4
registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd

s390x

registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99
registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2
registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b
registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634
registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff
registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.