CVE-2026-71576

Publié : 10 août 2026

Modifié : 10 août 2026

Score CVSS

8.5

HIGH

Description détaillée

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-71576 https://bugzilla.redhat.com/show_bug.cgi?id=2512513

Dernières Vulnérabilités

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

VOIR DÉTAILS

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

VOIR DÉTAILS

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

VOIR DÉTAILS