Description (CNA)
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Multicluster Global Hub 1.4.9 | unaffected 1788355599 before * |
| Red Hat / Multicluster Global Hub 1.5.8 | unaffected 1789515288 before * |
| Red Hat / Multicluster Global Hub 1.6.6 | unaffected 1790086176 before * |
| Red Hat / Multicluster Global Hub 1.7.3 | unaffected 1788377424 before * |
| Red Hat / Multicluster Global Hub 1.8.2 | unaffected 1788359454 before * |
| Red Hat / Multicluster Global Hub 1.8.2 | unaffected 1788359454 before * |
CWE
CWE-345
References
- https://access.redhat.com/errata/RHSA-2026:67516
- https://access.redhat.com/errata/RHSA-2026:67842
- https://access.redhat.com/errata/RHSA-2026:68515
- https://access.redhat.com/errata/RHSA-2026:71597
- https://access.redhat.com/errata/RHSA-2026:73038
- https://access.redhat.com/errata/RHSA-2026:73419
- https://access.redhat.com/security/cve/CVE-2026-71576
- https://bugzilla.redhat.com/show_bug.cgi?id=2512513
ADP enrichment
No English description supplied.
No references supplied.