VDB

CVE-2026-71577

CVE-2026-71577 PUBLISHED CVSS 6.3 MEDIUM

Reported by redhat · Published August 10, 2026

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

Risk Scores

CVSS 3.1
6.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red HatMulticluster Global Hub 1.4.91788355417
Red HatMulticluster Global Hub 1.5.81789478830
Red HatMulticluster Global Hub 1.6.61790085268
Red HatMulticluster Global Hub 1.7.31788372439
Red HatMulticluster Global Hub 1.8.21788359461
Red HatMulticluster Global Hub 1.8.21790638386
Red HatMulticluster Global Hub 1.5.81789478830
Red HatMulticluster Global Hub 1.6.61790085268
Red HatMulticluster Global Hub
Red HatMulticluster Global Hub 1.8.21788359461, 1790638386
Red HatMulticluster Global Hub 1.7.31788372439
Red HatMulticluster Global Hub 1.4.91788355417

Timeline

  • Aug 10, 2026 Coalition ESS Score
  • Aug 10, 2026 CVE Published
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 22, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 25, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score
  • Sep 30, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›