CVE-2026-71576

Name of the Vulnerable Software and Affected Versions multicluster-global-hub (affected versions not specified)

Description The manager component fails to properly validate the source identity of incoming CloudEvents on Kafka status topics. A remote attacker who has compromised a managed hub and obtained its Kafka client certificate can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data belonging to other hubs in the database, including compliance, inventory, and cluster health information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.