Description
A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.
Published: n/a
Score: 9.9 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.
Title multicluster-global-hub: multicluster-global-hub: shared Kafka gh-spec topic Write ACL plus spoofable CloudEvent source enables fleet-wide cluster-admin from any compromised managed hub
First Time appeared Redhat
Redhat multicluster Globalhub
Weaknesses CWE-290
CPEs cpe:/a:redhat:multicluster_globalhub:1.8::el9
Vendors & Products Redhat
Redhat multicluster Globalhub
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

threat_severity

Critical

Subscriptions

Redhat Multicluster Globalhub
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Critical

Publid Date: 2026-08-10T13:40:00Z

Links: CVE-2026-66801 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T01:45:06Z

Weaknesses