CVE-2026-71577

MEDIUM 6.3

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

CVSS Score

6.3

EPSS Score

0.4%

EPSS Percentile

28th

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

CWE	CWE-522
Vendor	red hat
Product	multicluster global hub 1.4.9
Published	Aug 10, 2026
Last Updated	Sep 24, 2026

Stay Ahead of the Next One

Get instant alerts for red hat multicluster global hub 1.4.9

Be the first to know when new medium vulnerabilities affecting red hat multicluster global hub 1.4.9 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Red Hat / Multicluster Global Hub 1.4.9

All versions affected

Red Hat / Multicluster Global Hub 1.5.8

All versions affected

Red Hat / Multicluster Global Hub 1.7.3

All versions affected

Red Hat / Multicluster Global Hub 1.8.2

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67516 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67842 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:68515 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:71597 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-71577 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2512514