PatchTheCVECVE-2026-71577: A flaw was found in multicluster-global-hub
CVE-2026-71577 is a medium-severity flaw (CVSS 6.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access a
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 64%) |
| CISA exploited list | No |
| Weakness | CWE-522 |
| Published | 2026-08-10 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-71577?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-71577 being exploited?
CVE-2026-71577 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-71577 affect?
CVE-2026-71577 affects affected software. Severity is medium (CVSS 6.3). A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensit
How urgent is CVE-2026-71577?
Priority 31/100. No elevated risk signals yet.