Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-71577

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Multicluster Global Hub 1.4.9

Default version status: affected

  • 1788355417 to < *unaffected

Red Hat Multicluster Global Hub 1.5.8

Default version status: affected

  • 1789478830 to < *unaffected

Red Hat Multicluster Global Hub 1.6.6

Default version status: affected

  • 1790085268 to < *unaffected

Red Hat Multicluster Global Hub 1.7.3

Default version status: affected

  • 1788372439 to < *unaffected

Red Hat Multicluster Global Hub 1.8.2

Default version status: affected

  • 1788359461 to < *unaffected

Red Hat Multicluster Global Hub 1.8.2

Default version status: affected

  • 1790638386 to < *unaffected

References