CVE-2026-71576highCWE-345

CVE-2026-71576: high-severity vulnerability in Red Hat Multicluster Global Hub 1.4.9

Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

Published · Updated

Follow this CVE+ Monitor Multicluster Global Hub

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Affected products
Red Hat · Multicluster Global Hub 1.4.9Red Hat · Multicluster Global Hub 1.5.8Red Hat · Multicluster Global Hub 1.6.6Red Hat · Multicluster Global Hub 1.7.3Red Hat · Multicluster Global Hub 1.8.2
Related CVEs — Red Hat Multicluster Global Hub 1.4.9

In the same product, most dangerous first.

CVE-2026-66792CRITICALMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersEPSS 0.7%CVE-2026-71577MEDIUMMulticluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migrationEPSS 0.4%