Threats affecting pkg:github/multicluster-global-hub

A vulnerability in multicluster-global-hub allows a compromised managed hub to gain read access to a shared communication topic during ManagedClusterMigration. This flaw enables interception of sensitive bootstrap kubeconfigs containing API server tokens intended for other hubs. These tokens have an extended validity of about 9.86 years, increasing the risk of unauthorized access and information disclosure across managed clusters. The issue has a CVSS score of 6.3 (medium severity). Red Hat has released security updates addressing this vulnerability in versions 1.4.9 and 1.7.3 of Multicluster Global Hub.