Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 17:58 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Exploitation evidence
Disclosed: evidence found.
CVE published 28 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red Hat Product Security Red Hat | Affected
| Fixed in– |
Description
Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1286Improper Validation of Syntactic Correctness of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-764Multiple Locks of a Critical Resource (opens in a new tab)
Base weakness
The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Implementation
When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)
Base weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-290Authentication Bypass by Spoofing (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
- OWASP Cheat Sheets
- Attack patterns
- Creating a Rogue Certification Authority Certificate (opens in a new tab)
- Web Services API Signature Forgery Leveraging Hash Function Extension Weakness (opens in a new tab)
- Signature Spoof (opens in a new tab)
- Signature Spoofing by Misrepresentation (opens in a new tab)
- Session Credential Falsification through Prediction (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-213Exposure of Sensitive Information Due to Incompatible Policies (opens in a new tab)
Base weaknessOWASP Top 10 A04:2021: Insecure Design (opens in a new tab)
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-425Direct Request ('Forced Browsing') (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Architecture and Design · Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Architecture and Design
Consider using MVC based frameworks such as Struts.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-214Invocation of Process Using Visible Sensitive Information (opens in a new tab)
Base weakness
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-306Missing Authentication for Critical Function (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #21OWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-266Incorrect Privilege Assignment (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Name not in the CWE catalogue (opens in a new tab)
- CWE-606Name not in the CWE catalogue (opens in a new tab)
- CWE-776Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:21769
- Vendor Severity
- high
- CVE Count
- 35
- Additional Cves
- CVE-2026-21728, CVE-2026-25679, CVE-2026-27137, CVE-2026-27889, CVE-2026-29785, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32285, CVE-2026-32286, CVE-2026-33186, CVE-2026-33215, CVE-2026-33216, CVE-2026-33217, CVE-2026-33218, CVE-2026-33219, CVE-2026-33247, CVE-2026-33413, CVE-2026-33487, CVE-2026-33810, CVE-2026-33813, CVE-2026-33997, CVE-2026-34040, CVE-2026-34986, CVE-2026-40890, CVE-2026-41602, CVE-2026-41603, CVE-2026-41604, CVE-2026-41605, CVE-2026-41606, CVE-2026-41607, CVE-2026-41636, CVE-2026-43869
References
- access.redhat.com/errata/RHSA-2026:21769 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-21728 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-25679 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-27137 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-27889 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-29785 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32280 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32281 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32282 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32283 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32285 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-32286 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33186 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33215 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33216 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33217 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33218 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33219 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33247 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-33413 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 releaseHighVulnerability
- Red Hat Security Advisory: OpenShift Container Platform 4.14.53 security and extras updateHighVulnerability
- Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem CatalogHighVulnerability
- Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix UpdateHighVulnerability
- Red Hat Security Advisory: OpenShift Container Platform 4.15.52 security and extras updateHighVulnerability