# CVE-2026-71577: Red Hat Multicluster Global Hub privilege escalation during ManagedClusterMigration

Source: https://junglewise.ai/threats/cve-2026-71577-red-hat-multicluster-global-hub-privilege-escalation-during  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71577 · Severity: medium · CVSS 6.3 · Published 2026-08-10

Red Hat Multicluster Global Hub is a Kubernetes management platform that allows organizations to manage multiple hub clusters from a central location. A flaw during cluster migrations incorrectly grants all managed hubs read access to shared communication channels, allowing a compromised hub to steal long-lived API tokens intended for other clusters. These tokens remain valid for approximately 10 years, providing attackers with sustained unauthorized access to other managed Kubernetes environments.

Technologies: [Red Hat Multicluster Global Hub](https://junglewise.ai/threats/technologies/multicluster-global-hub). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-71577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71577 being exploited in the wild.

**How severe is CVE-2026-71577?** Medium severity, with a CVSS score of 6.3, published 10 August 2026.

**Which products and versions are affected?** Red Hat Multicluster Global Hub before 1.4.9.

**Is there a fix for CVE-2026-71577?** A patch was published on 2026-09-15: Fix available in Multicluster Global Hub 1.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71577 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-71577?** Check whether you run Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access control flaw triggered during ManagedClusterMigration operations. The system improperly configures permissions on a shared communication topic, granting read access to all managed hubs instead of limiting access to intended recipients. An attacker controlling a compromised managed hub can intercept bootstrap kubeconfigs transiting the shared topic, extracting API server tokens with extended validity (~9.86 years). This enables unauthorized access and information disclosure across managed clusters. The vulnerability requires a managed hub to be compromised, but no network-level or authentication-level bypass is indicated—the flaw is in the migration logic itself. Patches are available in Multicluster Global Hub 1.4.9 and later.

## Affected products

- Red Hat Multicluster Global Hub before 1.4.9

## Timeline

- 2026-08-10: disclosed
- 2026-09-15: advisory: RHSA-2026:67516 published as security advisory
- 2026-09-15: patched: Fix available in Multicluster Global Hub 1.4.9

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHSA-2026:67516](https://access.redhat.com/errata/RHSA-2026:67516)

## Related threats

- [Red Hat Multicluster Global Hub authentication bypass in Kafka CloudEvents](https://junglewise.ai/threats/cve-2026-71576-red-hat-multicluster-global-hub-authentication-bypass-in-kafka)
- [Apache Thrift improper certificate validation in TSSLTransportFactory](https://junglewise.ai/threats/cve-2026-43869-apache-thrift-improper-certificate-validation-in)
- [Apache Thrift out-of-bounds read in C++ JSON implementation](https://junglewise.ai/threats/cve-2026-41607-apache-thrift-out-of-bounds-read-in-c-json-implementation)
- [Apache Thrift uncontrolled recursion in c_glib dispatch](https://junglewise.ai/threats/cve-2026-41606-apache-thrift-uncontrolled-recursion-in-c-glib-dispatch)
- [Apache Thrift integer overflow in Swift Compact Protocol](https://junglewise.ai/threats/cve-2026-41605-apache-thrift-integer-overflow-in-swift-compact-protocol)