The vulnerability arises due to insufficient sanitization of HTTP headers within the OpenShift Service Mesh, specifically allowing log injection attacks via the x-forwarded-for header. This could result in misleading log entries, potential XSS attacks, and misattribution of request sources. However, the impact is limited since it primarily affects logging and does not directly lead to remote code execution or privilege escalation.
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.10
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): kiali-ossmc-container: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat OpenShift Service Mesh Containers for 2.4.14
Important: Red Hat OpenShift Service Mesh Containers for 2.5.8
Important: Red Hat OpenShift Service Mesh Containers for 2.6.5
Low: Red Hat OpenShift Service Mesh Containers for 2.4.13
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.7
Important: Red Hat OpenShift Service Mesh Containers for 2.5.6
Moderate: Red Hat OpenShift Service Mesh Containers for 2.6.3
Important: Red Hat OpenShift Service Mesh Containers for 2.6.2
Important: Red Hat OpenShift Service Mesh Containers for 2.5.5
Important: Red Hat OpenShift Service Mesh Containers for 2.4.11
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): quic-go: memory exhaustion attack against QUIC's connection ID mechanism(CVE-2024-22189) moby: cert signing bypass(CVE-2018-12608) golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789) jose: resource exhaustion(CVE-2024-28176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application).
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Important: Red Hat OpenShift Service Mesh Containers for 2.4.8 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.2 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.1 security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset Attack) (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat OpenShift Service Mesh for 2.4.4 security update
Important: Red Hat OpenShift Service Mesh for 2.3.8 security update
Important: Red Hat OpenShift Service Mesh for 2.2.11 security update
Important: Red Hat OpenShift Service Mesh 2.2.10 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.3 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update
Important: Red Hat OpenShift Service Mesh 2.2.9 security update