CVE-2026-71576
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In multicluster-global-hub, the manager improperly validates the source identity of incoming CloudEvents on Kafka status topics, allowing a remote attacker to falsify or delete data.
Risk Assessment
An attacker can manipulate compliance, inventory, and cluster health data of other hubs, potentially leading to misinformation and data integrity compromise.
Recommendation
Update multicluster-global-hub to a patched version and strengthen Kafka client authentication.
Original NVD description (English source)
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.