CVE-2026-71577mediumCWE-522

CVE-2026-71577: falha de média gravidade em Red Hat Multicluster Global Hub 1.4.9

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Multicluster Global Hub

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Red Hat · Multicluster Global Hub 1.4.9Red Hat · Multicluster Global Hub 1.5.8Red Hat · Multicluster Global Hub 1.6.6Red Hat · Multicluster Global Hub 1.7.3Red Hat · Multicluster Global Hub 1.8.2
CVEs relacionadas — Red Hat Multicluster Global Hub 1.4.9

No mesmo produto, das mais perigosas para as menos.

CVE-2026-66792CRITICALMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersEPSS 0.7%CVE-2026-71576HIGHMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersEPSS 0.3%