CVE-2026-71576
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
67/100
Published: 2026-08-10
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
None
I:
High
A:
Low
Description
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.