CVE-2026-71577 is a security flaw in the multicluster-global-hub component where, during a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This misconfiguration allows a compromised managed hub to intercept bootstrap kubeconfigs containing API server tokens meant for other hubs. These tokens have an unusually long validity period of approximately 9.86 years, which significantly increases the risk of unauthorized access and information disclosure to other managed clusters. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting medium severity with network attack vector, high complexity, low privileges required, no user interaction, and confidentiality impact only. Red Hat has issued security advisories and updates for Multicluster Global Hub versions 1.4.9 and 1.7.3 to address this issue.

The vulnerability allows an attacker who has compromised one managed hub to read sensitive bootstrap kubeconfigs intended for other hubs. These kubeconfigs contain API server tokens with extended validity (~9.86 years), which could be used to gain unauthorized access to other managed clusters. This leads to a significant confidentiality breach risk across the multicluster environment. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Red Hat has released official security updates for Multicluster Global Hub versions 1.4.9 and 1.7.3 that address this vulnerability. Users should apply these updates promptly to remediate the issue. The vendor advisory does not indicate any temporary workarounds or that no action is required. Patch status is confirmed by Red Hat advisories RHSA-2026:67516 and RHSA-2026:67842. No cloud service remediation applies as this is not a cloud-hosted service.