Bug 2512514 (CVE-2026-71577)

Summary: CVE-2026-71577 multicluster-global-hub: multicluster-global-hub: Spec-topic Read ACL leaks bootstrap kubeconfigs to all managed hubs during migration
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gparvin, rhaigner, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-07 14:24:01 UTC 
A flaw was found in stolostron/multicluster-global-hub. The operator grants every managed-hub KafkaUser a Read ACL on the shared gh-spec topic (strimzi_transporter.go:353-364). During a ManagedClusterMigration, the manager builds a bootstrap kubeconfig containing a ManagedServiceAccount bearer token with a validity of 86400 * time.Hour (~9.86 years instead of the intended 24 hours) and ships it as plaintext JSON in the MigrationSourceBundle on gh-spec. Any compromised managed hub can subscribe with a fresh consumer group and harvest the target hub's apiserver token. No payload encryption or per-hub spec topic isolation exists; routing is client-side only.

Preconditions: (1) attacker compromises one managed hub and obtains its Kafka client certificate; (2) a ManagedClusterMigration is initiated by the global-hub admin (timing condition outside attacker control).

Fix: (1) change token validity from 86400 * time.Hour to 24 * time.Hour; (2) restrict spec-topic Read ACL to only the intended migration target hub.

Affected files: operator/pkg/controllers/transporter/protocol/strimzi_transporter.go:356-360, manager/pkg/migration/migration_initializing.go:277-321, agent/pkg/spec/migration/migration_from_syncer.go:469-480

Found by: Project Glasswing AI-assisted security audit (Red Hat Product Security)