CVE-2026-71576 describes a security flaw in the multicluster-global-hub manager component where it improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker who has compromised a managed hub and obtained its Kafka client certificate can manipulate the self-asserted source identity. This manipulation enables the attacker to falsify or delete critical data, including compliance, inventory, and cluster health information, that belongs to other hubs in the database. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity. Red Hat has issued multiple security advisories (e.g., RHSA-2026:67516, RHSA-2026:67842) providing updated container images and fixes in versions 1.4.9 and 1.7.3 of the multicluster-global-hub, which include security updates addressing this and other vulnerabilities.

The vulnerability allows an attacker with access to a compromised managed hub's Kafka client certificate to impersonate other hubs by manipulating the source identity in CloudEvents. This can lead to falsification or deletion of critical cluster data such as compliance reports, inventory details, and cluster health status. The impact is high on data integrity and availability within the multicluster-global-hub environment. Confidentiality is not directly impacted according to the CVSS vector.

Red Hat has released official security updates for multicluster-global-hub versions 1.4.9 and 1.7.3 that address this vulnerability. Users should apply these updates promptly by upgrading to these fixed versions or later. Refer to the Red Hat advisories RHSA-2026:67516 and RHSA-2026:67842 for detailed patch information and updated container images. No additional mitigations are specified beyond applying these official fixes.