4.3
Medium
CVE-2025-0754 The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6
Description
The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift Service Mesh 2 | Versions not published |
Other CVEs of OpenShift Service Mesh 2
The 45 CVEs of OpenShift Service Mesh 2 →
CVE-2026-47220
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
High
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium
CVE-2024-52011
launch-editor allows users to open files with line numbers in editor from Node.js
7.5
High
CVE-2026-45736
ws is an open source WebSocket client and server for Node.js
4.4
Medium