The Red Hat Multicluster Global Hub versions >=1.5.1 and <1.5.7 contain security vulnerabilities identified by CVE-2026-42306 and others. These vulnerabilities affect the components that allow importing and managing multiple hub clusters from a single hub cluster. Red Hat has released version 1.5.7 which includes security fixes to address these vulnerabilities. The advisory rates the security impact as critical but does not provide detailed CVSS scores. The vulnerabilities are associated with CWEs 367 (Time-of-check Time-of-use), 190 (Integer Overflow or Wraparound), and 290 (Authentication Bypass).

The vulnerabilities in affected versions of Multicluster Global Hub could potentially allow attackers to bypass authentication, cause integer overflows, or exploit race conditions (TOCTOU). This could lead to unauthorized access or disruption of cluster management operations. However, no known exploits are reported in the wild at this time.

Red Hat has released Multicluster Global Hub version 1.5.7 which contains security fixes addressing these vulnerabilities. Users should upgrade to version 1.5.7 to mitigate the risks. Refer to the official Red Hat advisory RHSA-2026:54577 and the Red Hat Advanced Cluster Management for Kubernetes documentation for detailed upgrade instructions.