REDHAT-BUG-2512513: High severity stolostron/multicluster-global-hub vulnerability
A flaw was found in stolostron/multicluster-global-hub. The manager component derives the leaf-hub identity from the self-asserted evt.Source() field of incoming CloudEvents on Kafka status topics (generichandler.go:67). The consumer chain (genericconsumer.go -> transportdispatcher.go -> conflationmanager.go) never validates evt.Source() against the Kafka topic name or the mTLS client principal. A compromised managed hub can set evt.Source() to a peer hub's name while writing to its own ACL-permitted gh-status topic. The manager regex-subscribes to ^gh-status. and routes by Source alone, allowing the attacker to falsify or delete another hub's compliance, inventory, and cluster health data in the database.
Precondition: attacker has compromised one managed hub and obtained its Strimzi-issued Kafka client certificate.
Fix: bind the self-asserted CloudEvent Source to the broker-enforced Kafka topic name (each hub's KafkaUser only has Write ACL on its own per-hub status topic).
Affected files: manager/pkg/status/handlers/generic/generichandler.go:67, hubclusterheartbeathandler.go:29, managedclusterhandler.go:59, localcompliancehandler.go:54, conflationmanager.go:70
Found by: Project Glasswing AI-assisted security audit (Red Hat Product Security)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the manager consumer/handlers so the leaf-hub identity is not derived from the self-asserted CloudEvent evt.Source(). Instead, bind/validate the CloudEvent Source to the broker-enforced Kafka topic name; each hub's KafkaUser has Write ACL only on its own per-hub status topic. Ensure the consumer chain (generic_consumer.go → transport_dispatcher.go → conflation_manager.go) validates evt.Source() against the Kafka topic name and that the manager regex subscription/routing no longer routes by Source alone (generic_handler.go:67 / hub_cluster_heartbeat_handler.go:29 / managedcluster_handler.go:59 / local_compliance_handler.go:54 / conflation_manager.go:70).
stolostron/multicluster-global-hub manager (CloudEvent handling / Kafka status topics) CloudEvent evt.Source() validation and mapping = Bind/validate self-asserted CloudEvent Source to the broker-enforced Kafka topic name for the per-hub status topic (use per-hub Kafka topic name derived from the Kafka topic received, not from evt.Source)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512513?
The severity of REDHAT-BUG-2512513 is classified as high with a score of 7.
What is the description of REDHAT-BUG-2512513?
REDHAT-BUG-2512513 describes a flaw in stolostron/multicluster-global-hub where the manager component improperly derives the leaf-hub identity from the self-asserted evt.Source() field of incoming CloudEvents.
How do I fix REDHAT-BUG-2512513?
To fix REDHAT-BUG-2512513, upgrade to the patched version of stolostron/multicluster-global-hub as soon as it is available.
What software is affected by REDHAT-BUG-2512513?
The software affected by REDHAT-BUG-2512513 is stolostron/multicluster-global-hub.
When was REDHAT-BUG-2512513 published?
REDHAT-BUG-2512513 was published on August 7, 2026.