Description
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [Kiali] | kiali | >= 0.4.0, < 1.15.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | jaeger | v1.13.1.redhat6-1.el7 | RHSA-2020:0972 |
| Red Hat Service Mesh 1 | kiali | v1.0.10.redhat1-1.el7 | RHSA-2020:0972 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kiali/kiali | >= 0.4.0, < 1.15.1 | 1.15.1 | GHSA-465w-gg5p-85c9 |
Advisories 1
- RHSA-2020:0972 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.10 Jaeger and Kiali security update Red Hat Security Advisories (RHSA) · Jun 29, 2026