CVE-2026-71576
The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
- CVSS 3.1
- 8.5 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
- EPSS
- 0.29% probability · 22th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-345
- Source
- secalert@redhat.com
EPSS 0.3% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://access.redhat.com/errata/RHSA-2026:67516
- https://access.redhat.com/errata/RHSA-2026:67842
- https://access.redhat.com/errata/RHSA-2026:68515
- https://access.redhat.com/errata/RHSA-2026:71597
- https://access.redhat.com/errata/RHSA-2026:73038
- https://access.redhat.com/errata/RHSA-2026:73419
- https://access.redhat.com/security/cve/CVE-2026-71576
- https://bugzilla.redhat.com/show_bug.cgi?id=2512513
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.