CVE-2026-71576: Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71576?
CVE-2026-71576 has a severity rating of high, with a score of 8.5.
How do I fix CVE-2026-71576?
To mitigate CVE-2026-71576, ensure proper validation of the source identity of incoming CloudEvents on Kafka status topics.
What type of vulnerability is CVE-2026-71576?
CVE-2026-71576 is a vulnerability that involves improper validation of self-asserted source identities.
Who can exploit CVE-2026-71576?
A remote attacker with a compromised managed hub and its Kafka client certificate can exploit CVE-2026-71576.
What is the impact of CVE-2026-71576 on system integrity?
CVE-2026-71576 can lead to a situation where an attacker can manipulate data due to a high potential for integrity issues.