Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-71576

Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Multicluster Global Hub 1.4.9

Default version status: affected

  • 1788355599 to < *unaffected

Red Hat Multicluster Global Hub 1.5.8

Default version status: affected

  • 1789515288 to < *unaffected

Red Hat Multicluster Global Hub 1.6.6

Default version status: affected

  • 1790086176 to < *unaffected

Red Hat Multicluster Global Hub 1.7.3

Default version status: affected

  • 1788377424 to < *unaffected

Red Hat Multicluster Global Hub 1.8.2

Default version status: affected

  • 1788359454 to < *unaffected

Red Hat Multicluster Global Hub 1.8.2

Default version status: affected

  • 1788359454 to < *unaffected

References