Description (CNA)
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Multicluster Global Hub 1.4.9 | unaffected 1788355417 before * |
| Red Hat / Multicluster Global Hub 1.5.8 | unaffected 1789478830 before * |
| Red Hat / Multicluster Global Hub 1.6.6 | unaffected 1790085268 before * |
| Red Hat / Multicluster Global Hub 1.7.3 | unaffected 1788372439 before * |
| Red Hat / Multicluster Global Hub 1.8.2 | unaffected 1788359461 before * |
| Red Hat / Multicluster Global Hub 1.8.2 | unaffected 1790638386 before * |
CWE
CWE-522
References
- https://access.redhat.com/errata/RHSA-2026:67516
- https://access.redhat.com/errata/RHSA-2026:67842
- https://access.redhat.com/errata/RHSA-2026:68515
- https://access.redhat.com/errata/RHSA-2026:71597
- https://access.redhat.com/errata/RHSA-2026:73038
- https://access.redhat.com/errata/RHSA-2026:73419
- https://access.redhat.com/security/cve/CVE-2026-71577
- https://bugzilla.redhat.com/show_bug.cgi?id=2512514
ADP enrichment
No English description supplied.
No references supplied.