CVE-2026-71576
Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers
- State
- Published
- Severity
- 8.5 High
- Published
- Aug 10, 2026
- Updated
- Sep 29, 2026
- Reserved
- Aug 7, 2026
Description
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L | redhat |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
Multicluster Global Hub 1.4.9Red Hat |
|
Multicluster Global Hub 1.5.8Red Hat |
|
Multicluster Global Hub 1.6.6Red Hat |
|
Multicluster Global Hub 1.7.3Red Hat |
|
Multicluster Global Hub 1.8.2Red Hat |
|
Multicluster Global Hub 1.8.2Red Hat |
|
References
- RHSA-2026:67516vendor-advisory
- RHSA-2026:67842vendor-advisory
- RHSA-2026:68515vendor-advisory
- RHSA-2026:71597vendor-advisory
- RHSA-2026:73038vendor-advisory
- RHSA-2026:73419vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-71576vdb-entry
- RHBZ#2512513issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.