REDHAT-BUG-2512514: Medium severity stolostron/multicluster-global-hub vulnerability
A flaw was found in stolostron/multicluster-global-hub. The operator grants every managed-hub KafkaUser a Read ACL on the shared gh-spec topic (strimzitransporter.go:353-364). During a ManagedClusterMigration, the manager builds a bootstrap kubeconfig containing a ManagedServiceAccount bearer token with a validity of 86400 time.Hour (~9.86 years instead of the intended 24 hours) and ships it as plaintext JSON in the MigrationSourceBundle on gh-spec. Any compromised managed hub can subscribe with a fresh consumer group and harvest the target hub's apiserver token. No payload encryption or per-hub spec topic isolation exists; routing is client-side only.
Preconditions: (1) attacker compromises one managed hub and obtains its Kafka client certificate; (2) a ManagedClusterMigration is initiated by the global-hub admin (timing condition outside attacker control).
Fix: (1) change token validity from 86400 time.Hour to 24 time.Hour; (2) restrict spec-topic Read ACL to only the intended migration target hub.
Affected files: operator/pkg/controllers/transporter/protocol/strimzitransporter.go:356-360, manager/pkg/migration/migrationinitializing.go:277-321, agent/pkg/spec/migration/migrationfromsyncer.go:469-480
Found by: Project Glasswing AI-assisted security audit (Red Hat Product Security)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stolostron/multicluster-global-hubto a version that resolves this vulnerability.Fixed in 24 * time.Hour - Configuration
In the migration code that builds the bootstrap kubeconfig (manager/pkg/migration/migration_initializing.go:277-321 and agent/pkg/spec/migration/migration_from_syncer.go:469-480), change the ManagedServiceAccount bearer token validity from 86400 * time.Hour to 24 * time.Hour.
ManagedClusterMigration bootstrap kubeconfig (ManagedServiceAccount bearer token validity) token validity = 24 * time.Hour - Configuration
Update the Kafka ACL configuration so the shared gh-spec topic Read access is granted only to the intended migration target hub (instead of granting every managed-hub KafkaUser a Read ACL on the shared gh-spec topic as in operator/pkg/controllers/transporter/protocol/strimzi_transporter.go:353-364).
Kafka gh-spec topic ACLs for ManagedClusterMigration spec-topic Read ACL scope = only the intended migration target hub
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512514?
The severity of REDHAT-BUG-2512514 is classified as medium, with a score of 4.
How do I fix REDHAT-BUG-2512514?
To fix REDHAT-BUG-2512514, update the stolostron/multicluster-global-hub to a version where the vulnerability is resolved.
What is the impact of REDHAT-BUG-2512514?
The impact of REDHAT-BUG-2512514 includes unauthorized access to the shared gh-spec topic due to improper ACL settings.
What software is affected by REDHAT-BUG-2512514?
The software affected by REDHAT-BUG-2512514 is stolostron/multicluster-global-hub.
When was REDHAT-BUG-2512514 published?
REDHAT-BUG-2512514 was published on August 7, 2026.