Is CVE-2026-71577 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71577 being exploited in the wild.

How severe is CVE-2026-71577?

Medium severity, with a CVSS score of 6.3, published 10 August 2026.

Which products and versions are affected?

Red Hat Multicluster Global Hub before 1.4.9.

Is there a fix for CVE-2026-71577?

A patch was published on 2026-09-15: Fix available in Multicluster Global Hub 1.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71577 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-71577?

Check whether you run Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71577: Red Hat Multicluster Global Hub privilege escalation during ManagedClusterMigration

CVE-2026-71577 · Severity: medium · CVSS 6.3 · Published 2026-08-10

Red Hat Multicluster Global Hub is a Kubernetes management platform that allows organizations to manage multiple hub clusters from a central location. A flaw during cluster migrations incorrectly grants all managed hubs read access to shared communication channels, allowing a compromised hub to steal long-lived API tokens intended for other clusters. These tokens remain valid for approximately 10 years, providing attackers with sustained unauthorized access to other managed Kubernetes environments.

Technologies: Red Hat Multicluster Global Hub. Vendors: Red Hat.

Quick answers

Is CVE-2026-71577 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71577 being exploited in the wild.
How severe is CVE-2026-71577?: Medium severity, with a CVSS score of 6.3, published 10 August 2026.
Which products and versions are affected?: Red Hat Multicluster Global Hub before 1.4.9.
Is there a fix for CVE-2026-71577?: A patch was published on 2026-09-15: Fix available in Multicluster Global Hub 1.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71577 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-71577?: Check whether you run Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an access control flaw triggered during ManagedClusterMigration operations. The system improperly configures permissions on a shared communication topic, granting read access to all managed hubs instead of limiting access to intended recipients. An attacker controlling a compromised managed hub can intercept bootstrap kubeconfigs transiting the shared topic, extracting API server tokens with extended validity (~9.86 years). This enables unauthorized access and information disclosure across managed clusters. The vulnerability requires a managed hub to be compromised, but no network-level or authentication-level bypass is indicated—the flaw is in the migration logic itself. Patches are available in Multicluster Global Hub 1.4.9 and later.

Affected products

Red Hat Multicluster Global Hub before 1.4.9

Timeline

2026-08-10: disclosed
2026-09-15: advisory: RHSA-2026:67516 published as security advisory
2026-09-15: patched: Fix available in Multicluster Global Hub 1.4.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.