Read the docs
TI-2020-01705 Aliases CVE-2020-1762GHSA-465w-gg5p-85c9

Session fixation in [Kiali] kiali

Priority MEDIUM 40CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing, Security bypass
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-384 and CWE-613.

Summary

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Why it matters now

EPSS 0.01153 67th percentileScored 2026-11-07
Fix Fixed kiali ([Kiali]): 1.15.1github.com/kiali/kiali (Go): 1.15.1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[Kiali]kiali0.4.0 to before 1.15.11.15.1Patch availableCNA
—github.com/kiali/kiali (Go)0.4.0 to before 1.15.11.15.1Patch availableGHSA-465w-gg5p-85c9
  • kiali Vendor[Kiali] Affected 0.4.0 to before 1.15.1 Fixed in 1.15.1 Patch available CNA
  • github.com/kiali/kiali (Go) Vendor— Affected 0.4.0 to before 1.15.1 Fixed in 1.15.1 Patch available GHSA-465w-gg5p-85c9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kiali:kiali:*:*:*:*:*:*:*:*0.4.0 to before 1.15.1Vulnerable[Kiali]
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
  • cpe:2.3:a:kiali:kiali:*:*:*:*:*:*:*:* Versions 0.4.0 to before 1.15.1 Vulnerable ·[Kiali]
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA kiali ([Kiali]) Fixed in 1.15.1
  • Fix · GHSA-465w-gg5p-85c9 github.com/kiali/kiali (Go) Fixed in 1.15.1 Advisory →

Red Hat 1 advisory

  • RHSA-2020:0972 Released 2020-03-25 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 1.0.10 Jaeger and Kiali security update
    • Red Hat OpenShift Service Mesh 1.0 jaeger-v1.13.1.redhat6-1.el7, kiali-v1.0.10.redhat1-1.el7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Service Mesh 1.0Fixed RHSA-2020:0972

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1762
  2. 2026-10-03 Alias added: GHSA-465w-gg5p-85c9

References

Advisory 3

Other 4

  • TI-2020-01707 Hard-coded credentials in Red Hat kiali CVSS 3.1HIGH 8.6
  • TI-2021-03569 Authentication bypass by spoofing in kiali CVSS 3.1MEDIUM 6.5
  • TI-2022-03631 Kiali: error message spoofing in kiali ui CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences