Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-71576Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

High 8.5

In plain English

A high-severity insufficient verification of data authenticity in Multicluster Global Hub 1.4.9 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.3%top 77.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

Affected products (as reported)

VendorProductVersions
Red Hat Multicluster Global Hub 1.4.9 see references
Red Hat Multicluster Global Hub 1.5.8 see references
Red Hat Multicluster Global Hub 1.6.6 see references
Red Hat Multicluster Global Hub 1.7.3 see references
Red Hat Multicluster Global Hub 1.8.2 see references
Red Hat Multicluster Global Hub 1.8.2 see references

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

References