DeutschShown in its original language — a full translation is planned for a future version.
Kiali für Red Hat OpenShift Service Mesh (Axios, Go, Follow-redirects): Mehrere Schwachstellen
view advisory published 2026-05-12
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kiali für Red Hat OpenShift Service Mesh ausnutzen, um erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-42044US | critical9.1 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows a… | ||||
| CVE-2026-42043US | critical10.0 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address i… | ||||
| CVE-2026-42041US | medium6.5 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows a… | ||||
| CVE-2026-42039US | high7.5 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested va… | ||||
| CVE-2026-42035US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) t… | ||||
| CVE-2026-42033US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios read… | ||||
| CVE-2026-40895US | high7.5 | — | ||
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a… | ||||
| CVE-2026-32280US | — | — | ||
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which ca… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-29035 vom 2026-07-17external
- Red Hat Security Advisory RHSA-2026:16532 vom 2026-05-12external
- Red Hat Security Advisory RHSA-2026:16534 vom 2026-05-12external
- Red Hat Security Advisory RHSA-2026:16535 vom 2026-05-12external
- Red Hat Security Advisory RHSA-2026:16542 vom 2026-05-12external
- Red Hat Security Advisory RHSA-2026:16874 vom 2026-05-13external
- Red Hat Security Advisory RHSA-2026:17084 vom 2026-05-13external
- Red Hat Security Advisory RHSA-2026:17287 vom 2026-05-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan