CVE-2026-71577

CVE-2026-71577 affects multicluster-global-hub. During a ManagedClusterMigration, the system grants all managed hubs read access to a shared communication topic, enabling a compromised hub to intercept bootstrap kubeconfigs containing API server tokens intended for other hubs. These tokens have a...

CVE-2026-71577 Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...