This advisory covers a set of vulnerabilities affecting Red Hat Multicluster Global Hub, notably CVE-2025-41118, which is a sensitive information disclosure vulnerability in Pyroscope when configured with Tencent Cloud Object Storage (COS) as backend. An attacker with direct access to the Pyroscope API can retrieve the COS secret_key in plaintext. The advisory includes multiple CVEs and rates the overall security impact as Important. The vulnerability has a CVSS v3.1 base score of 7.5 (high) according to Red Hat's assessment. The recommended mitigation is to restrict access to the Pyroscope API to trusted internal networks. The advisory references a general update to Multicluster Global Hub 1.7.1 with security and bug fixes but does not explicitly confirm a patch for this specific vulnerability. Users should consult the Red Hat advisory RHSA-2026:24503 for detailed remediation status.

The vulnerability allows an attacker with network access to the Pyroscope API to extract sensitive credentials (Tencent COS secret_key) in plaintext, which could lead to unauthorized access to cloud storage resources. This disclosure impacts confidentiality but does not affect integrity or availability. The overall security impact is rated as Important (high severity) by Red Hat. There are no known exploits in the wild at this time.

Red Hat recommends limiting network exposure of the Pyroscope API so that it is accessible only by trusted users on the internal network. This reduces the risk of unauthorized access to sensitive credentials. Users should monitor Red Hat advisories for official patches or updates. Since no explicit patch link is provided in the advisory, patch status is not yet confirmed—check the vendor advisory RHSA-2026:24503 for current remediation guidance.