CVE-2026-71577: Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-24
Weakness: CWE-522

Description

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

Affected products

Red Hat Multicluster Global Hub 1.4.9: all versions — fixed in 1788355417
Red Hat Multicluster Global Hub 1.5.8: all versions — fixed in 1789478830
Red Hat Multicluster Global Hub 1.6.6: all versions — fixed in 1790085268
Red Hat Multicluster Global Hub 1.7.3: all versions — fixed in 1788372439
Red Hat Multicluster Global Hub 1.8.2: all versions — fixed in 1788359461, 1790638386

How to fix

Upgrade to a fixed version: Red Hat Multicluster Global Hub 1.4.9 1788355417; Red Hat Multicluster Global Hub 1.5.8 1789478830; Red Hat Multicluster Global Hub 1.6.6 1790085268; Red Hat Multicluster Global Hub 1.7.3 1788372439; Red Hat Multicluster Global Hub 1.8.2 1788359461, 1790638386. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-71577 or the next vulnerability affects your stack