CVE-2026-71576
Full vulnerability record from the local CVENow database.
Description
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
Severity
HIGH
CVSS score
8.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-10 17:17:36.060000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-71576",
"sourceIdentifier": "[email protected]",
"published": "2026-08-10T17:17:36.060",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en multicluster-global-hub. El componente gestor valida incorrectamente la identidad de origen de los CloudEvents entrantes en los temas de estado de Kafka. Un atacante remoto, después de comprometer un hub gestionado y obtener su certificado de cliente Kafka, puede manipular la identidad de origen autoafirmada. Esto permite al atacante falsificar o eliminar datos críticos, como información de cumplimiento, inventario y estado del clúster, perteneciente a otros hubs en la base de datos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.4.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.4::el9"
],
"versions": [
{
"version": "1788355599",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.5.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.5::el9"
],
"versions": [
{
"version": "1789515288",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.6.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.6::el9"
],
"versions": [
{
"version": "1790086176",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.7.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.7::el9"
],
"versions": [
{
"version": "1788377424",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.8.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.8::el9"
],
"versions": [
{
"version": "1788359454",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Global Hub 1.8.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.8::el9"
],
"versions": [
{
"version": "1788359454",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.1,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-12T15:44:50.677334Z",
"id": "CVE-2026-71576",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-345"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:67516",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:67842",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68515",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:71597",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:73038",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:73419",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-71576",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512513",
"source": "[email protected]"
}
]
}