RHSA-2026:8493: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.2, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.Security Fix(es): CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13237, OSSM-13238) CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-13272) CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-13274, OSSM-13275) CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-13276, OSSM-13277, OSSM-13278) CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13279, OSSM-13280) CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13281, OSSM-13282) CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13283) CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13284, OSSM-13285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat