CVE-2026-116498
Description
A missing authorization flaw was found in Kiali, where the namespace health, ztunnel pod log, and ztunnel configuration dump API endpoints returned data about namespaces the caller had no RBAC access to, reading ztunnel data with the Kiali ServiceAccount without checking the caller's permissions. Additionally, the openshift authentication strategy accepted tokens that could not view any namespace. An attacker with any valid OpenShift token could read other tenants' workload names, health, traffic topology, workload identities, pod addresses and mesh policies, resulting in information disclosure across tenant boundaries.
Statement
This vulnerability is rated as Moderate severity because exploitation requires a valid authenticated cluster token and disclosure is restricted to read-only telemetry, proxy logs, and mesh configuration without exposing sensitive secrets or enabling data tampering. In Red Hat OpenShift Service Mesh, authenticated users or service accounts can retrieve cross-namespace metrics and operational logs beyond their assigned RBAC permissions. Because the flaw cannot be leveraged for remote code execution or privilege escalation to alter cluster resources, its overall risk remains limited.
Mitigation
Set kiali_internal.health_cache.enabled to false to close the health endpoint exposure, and add logs-tab to kiali_feature_flags.disabled_features to close the ztunnel log exposure. There is no configuration that closes the ztunnel config dump endpoint; upgrade to a fixed version.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Red Hat CVSS v3 Score Explanation
Primary score 4.3 (Moderate), applied per finding: all three endpoints share this vector. Judgment calls documented for secondary assessment: S:C instead of S:U would give 5.0 per finding (data fetched with Kiali's cluster-wide ServiceAccount across the tenant RBAC boundary); C:H for the ztunnel config dump finding would give 6.5 (full mesh configuration disclosed in one request), or 7.7 if both applied. The openshift auth-strategy login gap is not separately scored: it does not change PR:L. Reporter aggregate assessment was also 4.3.
Acknowledgements
Red Hat would like to thank Daniel Wallin (Conoa) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
