A flaw was found in stolostron/multicluster-global-hub. The operator grants every managed-hub KafkaUser a Read ACL on the shared gh-spec topic (strimzi_transporter.go:353-364). During a ManagedClusterMigration, the manager builds a bootstrap kubeconfig containing a ManagedServiceAccount bearer token with a validity of 86400 * time.Hour (~9.86 years instead of the intended 24 hours) and ships it as plaintext JSON in the MigrationSourceBundle on gh-spec. Any compromised managed hub can subscribe with a fresh consumer group and harvest the target hub's apiserver token. No payload encryption or per-hub spec topic isolation exists; routing is client-side only.

Preconditions: (1) attacker compromises one managed hub and obtains its Kafka client certificate; (2) a ManagedClusterMigration is initiated by the global-hub admin (timing condition outside attacker control).

Fix: (1) change token validity from 86400 * time.Hour to 24 * time.Hour; (2) restrict spec-topic Read ACL to only the intended migration target hub.

Affected files: operator/pkg/controllers/transporter/protocol/strimzi_transporter.go:356-360, manager/pkg/migration/migration_initializing.go:277-321, agent/pkg/spec/migration/migration_from_syncer.go:469-480

Found by: Project Glasswing AI-assisted security audit (Red Hat Product Security)