The vulnerability in Red Hat Multicluster Global Hub arises because during a ManagedClusterMigration, the system grants all managed hubs read access to a shared Kafka topic. This allows a compromised managed hub to intercept bootstrap kubeconfigs intended for other hubs. These kubeconfigs contain API server tokens with an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure across managed clusters. Exploitation requires both a prior compromise of a managed hub and an active migration operation. Red Hat has not provided a patch or effective mitigation that meets their standards for deployment and stability.

A compromised managed hub can obtain long-lived API server tokens for other managed hubs, enabling unauthorized access to those clusters. The tokens' extended validity period (around 9.86 years) exacerbates the risk of prolonged unauthorized access and potential information disclosure. The vulnerability affects confidentiality but does not impact integrity or availability. Exploitation requires prior access to a managed hub and an active migration, limiting the attack vector but still posing a significant risk in multi-cluster environments.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates. Exploitation requires prior compromise of a managed hub and an active migration, so limiting exposure and securing managed hubs may reduce risk. Customers with a Technical Account Manager (TAM) can consult directly with Red Hat for guidance. No official fix or temporary workaround is provided at this time.