Multicluster Global Hub
Monthly
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing bootstrap kubeconfigs - containing API server tokens - to any managed hub that reads the shared communication topic. A compromised managed hub can silently harvest these credentials, which carry an approximately 9.86-year validity window, enabling long-lived unauthorized access to other managed clusters well beyond the migration event itself. No public exploit has been identified at time of analysis, but the extended token lifetime dramatically amplifies post-compromise dwell risk.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing bootstrap kubeconfigs - containing API server tokens - to any managed hub that reads the shared communication topic. A compromised managed hub can silently harvest these credentials, which carry an approximately 9.86-year validity window, enabling long-lived unauthorized access to other managed clusters well beyond the migration event itself. No public exploit has been identified at time of analysis, but the extended token lifetime dramatically amplifies post-compromise dwell risk.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.