Red Hat Multicluster Global Hub versions 1.6.0 through 1.6.5 contain critical security vulnerabilities identified under CVE-2026-42306 and related CVEs. The product allows centralized management of multiple Kubernetes hub clusters. The vulnerabilities are rated critical by Red Hat Product Security, though no detailed technical descriptions or exploit methods are provided in the advisory. The update to version 1.6.5 includes security fixes and updated container images to address these issues. The advisory references CWE identifiers CWE-367 (Time-of-check Time-of-use), CWE-190 (Integer Overflow or Wraparound), and CWE-290 (Authentication Bypass), indicating the nature of the vulnerabilities.

The vulnerabilities in affected versions of Red Hat Multicluster Global Hub could potentially allow attackers to bypass authentication, cause integer overflows, or exploit race conditions (TOCTOU). These issues could lead to unauthorized access or disruption of cluster management operations. The critical severity rating indicates a high potential impact on confidentiality, integrity, or availability of the managed Kubernetes clusters. However, no known exploits in the wild have been reported at this time.

Red Hat has released version 1.6.5 of Multicluster Global Hub which includes security fixes for the identified vulnerabilities. Users should upgrade to version 1.6.5 or later as soon as possible. The vendor advisory does not indicate any temporary workarounds or mitigations other than applying the update. Refer to the official Red Hat Advanced Cluster Management for Kubernetes documentation for upgrade instructions.