What is the CVSS score of CVE-2026-71577?

CVE-2026-71577 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Multicluster Global Hub CVE-2026-71577

EUVD-2026-55676 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-08-10 redhat

GHSA-v7q5-q7p3-9vjm

Authentication Bypass Information Disclosure Multicluster Global Hub Red Hat

6.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

AC:H reflects the migration-event prerequisite; PR:L reflects required hub compromise; S:C captures cross-hub credential exposure; I/A:N as tokens enable access, not direct modification.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

6.3 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 17:21 vuln.today

DescriptionCVE.org

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

AnalysisAI

Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing bootstrap kubeconfigs - containing API server tokens - to any managed hub that reads the shared communication topic. A compromised managed hub can silently harvest these credentials, which carry an approximately 9.86-year validity window, enabling long-lived unauthorized access to other managed clusters well beyond the migration event itself. No public exploit has been identified at time of analysis, but the extended token lifetime dramatically amplifies post-compromise dwell risk.

Technical ContextAI

Red Hat multicluster-global-hub is an operator-layer product that centralizes fleet management across multiple Red Hat Advanced Cluster Management (RHACM) hub instances. Its ManagedClusterMigration workflow relies on a shared messaging topic - likely a Kafka or similar message-bus channel - to coordinate state and distribute bootstrap kubeconfigs to recipient hubs. The root cause maps to CWE-522 (Insufficiently Protected Credentials): instead of scoping read access on this shared topic to the intended recipient hub, the system grants read permissions to all managed hubs simultaneously. The affected CPE is cpe:2.3:a:red_hat:multicluster_global_hub:*:*:*:*:*:*:*:* - the wildcard version range indicates all currently tracked releases are affected. Bootstrap kubeconfigs embed API server bearer tokens for cluster agent registration; their ~9.86-year TTL is anomalously long and was almost certainly not designed with credential-theft scenarios in mind.

RemediationAI

The primary remediation is to apply the vendor-supplied patch per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71577 - no specific patched version number is confirmed in the available data, so administrators should review the advisory and Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2512514 for the precise fixed release. As an immediate compensating control, suspend or postpone non-critical ManagedClusterMigration operations until the patch is applied, since the vulnerable code path is only triggered during active migration events. If migrations must proceed, isolate managed hub networks at the message-bus level so that only the intended recipient hub has read access to migration topics; this directly addresses the overly broad topic ACL that is the root cause. Additionally, given the approximately 9.86-year token validity, any bootstrap kubeconfigs distributed during prior migrations on unpatched systems should be treated as potentially compromised: rotate the API server tokens embedded in those kubeconfigs and audit access logs for anomalous API calls originating from hub agent identities. Token rotation on live clusters carries a brief service disruption risk during agent re-registration and should be planned accordingly.