Kiali 1.73.32, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.Security Fix(es): CVE-2026-9277 openshift-service-mesh/kiali-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13906) CVE-2026-9277 openshift-service-mesh/kiali-ossmc-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.