CVE-2026-71577mediumCWE-522

CVE-2026-71577: medium-severity vulnerability in Red Hat Multicluster Global Hub 1.4.9

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Published · Updated

Follow this CVE+ Monitor Multicluster Global Hub

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.4%
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Red Hat · Multicluster Global Hub 1.4.9Red Hat · Multicluster Global Hub 1.5.8Red Hat · Multicluster Global Hub 1.6.6Red Hat · Multicluster Global Hub 1.7.3Red Hat · Multicluster Global Hub 1.8.2
Related CVEs — Red Hat Multicluster Global Hub 1.4.9

In the same product, most dangerous first.

CVE-2026-66792CRITICALMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersEPSS 0.7%CVE-2026-71576HIGHMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersEPSS 0.3%