EUVD-2026-55676
GHSA-v7q5-q7p3-9vjm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
AC:H reflects the migration-event prerequisite; PR:L reflects required hub compromise; S:C captures cross-hub credential exposure; I/A:N as tokens enable access, not direct modification.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
AnalysisAI
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing bootstrap kubeconfigs - containing API server tokens - to any managed hub that reads the shared communication topic. A compromised managed hub can silently harvest these credentials, which carry an approximately 9.86-year validity window, enabling long-lived unauthorized access to other managed clusters well beyond the migration event itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous preconditions: the attacker must have already compromised a managed hub with sufficient access to read from the shared communication topic, and a ManagedClusterMigration must be actively in progress at the time of the attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 base score with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N encodes the key risk signals accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained shell or operator-level access to one managed hub in the fleet waits for or triggers a ManagedClusterMigration event. During the migration, the misconfigured shared topic becomes readable by the compromised hub, allowing the attacker to capture bootstrap kubeconfigs - including API server bearer tokens - intended for other managed hubs. … |
| Remediation | The primary remediation is to apply the vendor-supplied patch per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71577 - no specific patched version number is confirmed in the available data, so administrators should review the advisory and Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2512514 for the precise fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multicluster Global Hub
View allPrivilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today