Sensitive Information Exposure in Multicluster Global Hub by Red Hat
CVE-2026-71577

6.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Multicluster Global Hub
Vendor
CVE Published:
10 August 2026

What is CVE-2026-71577?

A security flaw has been identified in Multicluster Global Hub that compromises the integrity of managed clusters during a ManagedClusterMigration. The vulnerability arises from improper permission settings, allowing all managed hubs to gain read access to a common communication topic. This inappropriate access enables a compromised hub to intercept sensitive bootstrap kubeconfigs, which contain API server tokens. These tokens, characterized by an extraordinarily long validity period of nearly 10 years, pose a significant risk, potentially leading to unauthorized data access and severe information disclosure across managed clusters.

References

https://access.redhat.com/security/cve/CVE-2026-71577
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2512514
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.