CVE-2026-71577mediumCWE-522

CVE-2026-71577: fallo de gravedad media en Red Hat Multicluster Global Hub 1.4.9

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Multicluster Global Hub

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.4%
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Red Hat · Multicluster Global Hub 1.4.9Red Hat · Multicluster Global Hub 1.5.8Red Hat · Multicluster Global Hub 1.6.6Red Hat · Multicluster Global Hub 1.7.3Red Hat · Multicluster Global Hub 1.8.2
CVEs relacionadas — Red Hat Multicluster Global Hub 1.4.9

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-66792CRITICALMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersEPSS 0.7%CVE-2026-71576HIGHMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersEPSS 0.3%