A missing authorization flaw in Kiali allows an authenticated caller to access the namespace health, ztunnel pod log, and ztunnel configuration dump API endpoints without checking the caller’s RBAC permissions. The Kiali ServiceAccount is used to retrieve ztunnel data, and the OpenShift authentication strategy accepts tokens that have no visibility into any namespace. The result is that any user possessing a valid OpenShift token can read workload names, health status, traffic topology, identities, pod addresses and mesh policies of other tenants, yielding cross‑tenant information disclosure.

The vulnerability affects Kiali, the observability console for Istio/Service Mesh deployments. The CVE entry does not list specific release versions, so all installations of Kiali that contain the vulnerable APIs are potentially impacted until a patch is applied.

The CVSS score of 4.3 indicates low to moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS data is unavailable, so the exploitation probability cannot be quantified from available public sources. An attacker requires a valid OpenShift token, which can be acquired through normal authentication processes; once authenticated, the attacker can simply call the vulnerable endpoints and obtain sensitive data. No additional foothold or privileged escalation is required beyond token possession.