CVE-2026-83550: Active Debug Code in Red Hat Multicluster Global Hub

The vulnerability arises from a blank import of the net/http/pprof package in the postgres-exporter used by Red Hat Multicluster Global Hub. This import exposes debug endpoints on an unauthenticated metrics listener accessible within the cluster network. Exploiting these endpoints allows an attacker to disclose sensitive information including process arguments, full goroutine stacks, and potentially sensitive data like database connection strings or passwords from heap dumps. Furthermore, repeated CPU profiling requests can lead to denial of service conditions by exhausting CPU resources.

An attacker with network access inside the cluster can obtain sensitive information that may aid further attacks or compromise confidentiality. The vulnerability also allows denial of service via resource exhaustion through repeated CPU profiling. The CVSS score of 7.1 (high) reflects the potential for information disclosure and availability impact without requiring privileges or user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-83550 for current remediation guidance. Until a fix is available, restrict network access to the metrics listener to trusted users only to prevent unauthorized access to debug endpoints.