VDB

CVE-2026-71576

CVE-2026-71576 PUBLISHED CVSS 8.5 HIGH

Reported by redhat · Published August 10, 2026

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

Risk Scores

CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Affected Products

VendorProductVersions
Red HatMulticluster Global Hub 1.4.91788355599
Red HatMulticluster Global Hub 1.5.81789515288
Red HatMulticluster Global Hub 1.6.61790086176
Red HatMulticluster Global Hub 1.7.31788377424
Red HatMulticluster Global Hub 1.8.21788359454
Red HatMulticluster Global Hub 1.8.21788359454
Red HatMulticluster Global Hub 1.4.91788355599
Red HatMulticluster Global Hub
Red HatMulticluster Global Hub 1.6.61790086176
Red HatMulticluster Global Hub 1.8.21788359454, 1788359454, 1788359454
Red HatMulticluster Global Hub 1.5.81789515288
Red HatMulticluster Global Hub 1.7.31788377424

Timeline

  • Aug 10, 2026 Coalition ESS Score
  • Aug 10, 2026 CVE Published
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Sep 22, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 25, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›