The vulnerability in Red Hat Multicluster Global Hub arises from improper validation of the source identity in CloudEvents received on Kafka status topics by the manager component. A remote attacker, after compromising a managed hub and acquiring its Kafka client certificate, can manipulate the self-asserted source identity to impersonate other hubs. This enables the attacker to falsify or delete critical data related to compliance, inventory, and cluster health in the database, causing significant data integrity issues. Red Hat has classified this flaw as important and has not yet provided an official fix or effective mitigation that meets their product security standards.

The vulnerability allows an attacker with low privileges (compromised managed hub and Kafka client certificate) to impersonate other hubs within the Multicluster Global Hub environment. This can lead to falsification or deletion of critical data such as compliance, inventory, and cluster health information, resulting in significant data integrity problems. There is no impact on confidentiality, but integrity is highly affected and availability impact is low. No known exploits in the wild have been reported.

Currently, there is no available mitigation or fix that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's official advisory for updates. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Until a fix or mitigation is provided, caution should be exercised in managing access to Kafka client certificates and the security of managed hubs.