Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration (Red Hat Multicluster Global Hub 1.4.9)
En bref
- Source
- NVD
- EPSS
- EPSS 0.42 % · centile 37 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Awaiting Analysis
Description
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
Faiblesses (CWE)
- CWE-522 — Identifiants insuffisamment protégés
Références
- https://access.redhat.com/errata/RHSA-2026:67516
- https://access.redhat.com/errata/RHSA-2026:67842
- https://access.redhat.com/errata/RHSA-2026:68515
- https://access.redhat.com/errata/RHSA-2026:71597
- https://access.redhat.com/errata/RHSA-2026:73038
- https://access.redhat.com/errata/RHSA-2026:73419
- https://access.redhat.com/security/cve/CVE-2026-71577
- https://bugzilla.redhat.com/show_bug.cgi?id=2512514
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-55676
- GCVE · GCVE-0-2026-71577
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Multicluster Global Hub 1.4.9 | unaffected 1788355417 < * |
| Red Hat · Multicluster Global Hub 1.5.8 | unaffected 1789478830 < * |
| Red Hat · Multicluster Global Hub 1.6.6 | unaffected 1790085268 < * |
| Red Hat · Multicluster Global Hub 1.7.3 | unaffected 1788372439 < * |
| Red Hat · Multicluster Global Hub 1.8.2 | unaffected 1788359461 < * |
| Red Hat · Multicluster Global Hub 1.8.2 | unaffected 1790638386 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |