CVE-2026-116498

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Daniel Wallin (Conoa) for reporting this issue.", "bugzilla": {"description": "kiali: Kiali: missing namespace authorization in health, ztunnel logs, and ztunnel config dump APIs", "id": "2561982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561982"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-862", "details": ["A missing authorization flaw was found in Kiali, where the namespace health, ztunnel pod log, and ztunnel configuration dump API endpoints returned data about namespaces the caller had no RBAC access to, reading ztunnel data with the Kiali ServiceAccount without checking the caller's permissions. Additionally, the openshift authentication strategy accepted tokens that could not view any namespace. An attacker with any valid OpenShift token could read other tenants' workload names, health, traffic topology, workload identities, pod addresses and mesh policies, resulting in information disclosure across tenant boundaries."], "mitigation": {"lang": "en:us", "value": "Set kiali_internal.health_cache.enabled to false to close the health endpoint exposure, and add logs-tab to kiali_feature_flags.disabled_features to close the ztunnel log exposure. There is no configuration that closes the ztunnel config dump endpoint; upgrade to a fixed version."}, "name": "CVE-2026-116498", "package_state": [{"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Affected", "package_name": "openshift-service-mesh/kiali-rhel9", "product_name": "OpenShift Service Mesh 3"}], "public_date": "2026-10-26T17:21:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116498\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116498\nhttps://github.com/kiali/kiali/pull/10437"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires a valid authenticated cluster token and disclosure is restricted to read-only telemetry, proxy logs, and mesh configuration without exposing sensitive secrets or enabling data tampering. In Red Hat OpenShift Service Mesh, authenticated users or service accounts can retrieve cross-namespace metrics and operational logs beyond their assigned RBAC permissions. Because the flaw cannot be leveraged for remote code execution or privilege escalation to alter cluster resources, its overall risk remains limited.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "kiali", "vendor": "kiali"}], "created": "2026-10-29T13:45:17.575688+00:00", "updated": "2026-10-29T14:45:14.336895+00:00", "vendors": ["kiali", "kiali$PRODUCT$kiali"]}