Read the docs
TI-2021-02454 Aliases CVE-2021-3495GHSA-mv55-23xp-3wp8

An incorrect access control flaw was found in the kiali-operator in versions before…

Priority MEDIUM 40CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Why it matters now

EPSS 0.00969 62nd percentileScored 2026-11-07
Fix Partial github.com/kiali/kiali (Go): 1.33.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—kiali/kiali-operatorkiali/kiali-operator 1.33.0, kiali/kiali-operator 1.24.7—No fix listedCNA
—github.com/kiali/kiali (Go)before 1.33.01.33.0Patch availableGHSA-mv55-23xp-3wp8
  • kiali/kiali-operator Vendor— Affected kiali/kiali-operator 1.33.0, kiali/kiali-operator 1.24.7 Fixed in — No fix listed CNA
  • github.com/kiali/kiali (Go) Vendor— Affected before 1.33.0 Fixed in 1.33.0 Patch available GHSA-mv55-23xp-3wp8

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:netlify:kiali-operator:*:*:*:*:*:*:*:*before 1.24.7; 1.30.0 to before 1.33.0Vulnerablenetlify
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:a:netlify:kiali-operator:*:*:*:*:*:*:*:* Versions before 1.24.7; 1.30.0 to before 1.33.0 Vulnerable ·netlify
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-mv55-23xp-3wp8 github.com/kiali/kiali (Go) Fixed in 1.33.0 Advisory →

Red Hat 1 advisory

  • RHSA-2021:1544 Released 2021-05-11 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.0.4 security update
    • OpenShift Service Mesh 2.0 openshift-service-mesh/kiali-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Out of support scope
OpenShift Service Mesh 2.0Fixed RHSA-2021:1544

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3495
  2. 2026-10-03 Alias added: GHSA-mv55-23xp-3wp8

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences