What is the CVSS score of CVE-2026-71576?

CVE-2026-71576 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Multicluster Global Hub are affected by CVE-2026-71576?

A flaw in Red Hat Multicluster Global Hub's identity validation allows a network-adjacent attacker who has compromised one managed hub to impersonate other hubs and corrupt compliance records,…

How to fix or mitigate CVE-2026-71576?

Within 24 hours, verify which versions of Red Hat Multicluster Global Hub are deployed and assess whether any managed hubs have been compromised; simultaneously restrict network access to the internal Kafka status bus to only authorized hub components and implement CloudEvent source identity validation at the manager component layer. Within 7 days, conduct a forensic review of compliance record, inventory, and cluster health data modifications across all hubs to detect unauthorized changes from the past 90 days, and segment managed hubs to limit lateral movement if compromise is discovered. Within 30 days, implement continuous monitoring and audit logging for all modifications to compliance and inventory records, enforce mutual TLS certificate validation, monitor Red Hat security advisories for patch availability, and establish a deployment process to apply the patch immediately upon release.

Multicluster Global Hub CVE-2026-71576

EUVD-2026-55674 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-10 redhat

GHSA-q5c4-r3vh-f379

Information Disclosure Multicluster Global Hub Red Hat

8.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

AC:H reflects the mandatory prerequisite of prior hub compromise to obtain credentials; remaining metrics align with vendor vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 17:20 vuln.today

CVE Published

Aug 10, 2026 - 16:41 cve.org

HIGH 8.5

DescriptionCVE.org

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

AnalysisAI

Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.

Technical ContextAI

The affected component is the manager in Red Hat Multicluster Global Hub (CPE: cpe:2.3:a:red_hat:multicluster_global_hub:*:*:*:*:*:*:*:*), a Kubernetes-native solution for managing fleets of OpenShift/ACM hub clusters. Hubs communicate status via CloudEvents transported over Apache Kafka, using mTLS client certificates for transport-layer authentication. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): the manager trusts the self-asserted 'source' field in incoming CloudEvent payloads rather than cryptographically binding the event's source identity to the presenting Kafka client certificate. Because certificate ownership and CloudEvent source claims are validated independently, a certificate from hub-A can be used to publish events asserting they originate from hub-B.

RemediationAI

Patch available per vendor advisory - consult https://access.redhat.com/security/cve/CVE-2026-71576 for the specific patched release, as an exact fix version was not included in the available data at time of analysis. As a compensating control prior to patching, restrict Kafka topic write permissions so that each managed hub's client certificate is authorized only to produce on its own designated status topic, preventing cross-hub topic writes at the broker ACL layer; this adds broker-side enforcement that does not rely on application-layer source validation. Additionally, audit the manager's CloudEvent ingestion pipeline to verify that the source field is validated against the presenting client certificate's Subject or SAN, and consider deploying Kafka audit logging to detect anomalous cross-hub source claims. These controls reduce risk but do not eliminate the root CWE-345 flaw, which requires a code-level fix from Red Hat.