Logo
Retour à la veille

CVE-2026-71577

Publié : 10 août 2026
Modifié : 10 août 2026
Lien officiel NVD
Score CVSS
6.3
MEDIUM

Description détaillée

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-71577https://bugzilla.redhat.com/show_bug.cgi?id=2512514

Dernières Vulnérabilités

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

VOIR DÉTAILS

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

VOIR DÉTAILS

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

VOIR DÉTAILS