Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration (Red Hat Multicluster Global Hub 1.4.9)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.42 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Awaiting Analysis
Description
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
Weaknesses (CWE)
- CWE-522 — Insufficiently Protected Credentials
References
- https://access.redhat.com/errata/RHSA-2026:67516
- https://access.redhat.com/errata/RHSA-2026:67842
- https://access.redhat.com/errata/RHSA-2026:68515
- https://access.redhat.com/errata/RHSA-2026:71597
- https://access.redhat.com/errata/RHSA-2026:73038
- https://access.redhat.com/errata/RHSA-2026:73419
- https://access.redhat.com/security/cve/CVE-2026-71577
- https://bugzilla.redhat.com/show_bug.cgi?id=2512514
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-55676
- GCVE · GCVE-0-2026-71577
Affected products
| Product | Versions |
|---|---|
| Red Hat · Multicluster Global Hub 1.4.9 | unaffected 1788355417 < * |
| Red Hat · Multicluster Global Hub 1.5.8 | unaffected 1789478830 < * |
| Red Hat · Multicluster Global Hub 1.6.6 | unaffected 1790085268 < * |
| Red Hat · Multicluster Global Hub 1.7.3 | unaffected 1788372439 < * |
| Red Hat · Multicluster Global Hub 1.8.2 | unaffected 1788359461 < * |
| Red Hat · Multicluster Global Hub 1.8.2 | unaffected 1790638386 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |