EUVD-2026-55674
GHSA-q5c4-r3vh-f379
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
AC:H reflects the mandatory prerequisite of prior hub compromise to obtain credentials; remaining metrics align with vendor vector.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
AnalysisAI
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has already compromised a managed hub cluster to the degree necessary to extract its Kafka mTLS client certificate and private key - this is a significant prerequisite that limits opportunistic exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H/A:L) accurately reflects the core risk profile: network-reachable, low complexity once a hub is compromised, requiring low-privilege Kafka credentials, with a changed scope that extends integrity damage across the entire management plane. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has achieved initial access to a managed hub cluster - for example through a compromised workload or stolen kubeconfig - extracts the hub's Kafka mTLS client certificate and key from cluster secrets. Using that certificate to authenticate to the shared Kafka broker, the attacker publishes crafted CloudEvents to the Kafka status topics with the source field set to a different, high-value hub's identity. … |
| Remediation | Patch available per vendor advisory - consult https://access.redhat.com/security/cve/CVE-2026-71576 for the specific patched release, as an exact fix version was not included in the available data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify which versions of Red Hat Multicluster Global Hub are deployed and assess whether any managed hubs have been compromised; simultaneously restrict network access to the internal Kafka status bus to only authorized hub components and implement CloudEvent source identity validation at the manager component layer. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multicluster Global Hub
View allPrivilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing boots
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today