Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    RHSA-2026:52946

    Vulnerability from csaf_redhat - Published: 2026-08-10 16:32 - Updated: 2026-09-24 10:30
    Summary
    Red Hat Security Advisory: Multicluster Global Hub 1.8.1 security update
    Severity
    Critical
    Scope
    7 vulnerabilities in this advisory, including CVE-2026-66801.
    CVE-2026-66801

    A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.

    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Fixed: 4 products Known not affected: 17 products
    https://access.redhat.com/errata/RHSA-2026:52946
    Open the full advisory

    RHSA-2026:53530

    Vulnerability from csaf_redhat - Published: 2026-08-11 14:11 - Updated: 2026-09-24 11:01
    Summary
    Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update
    Severity
    Critical
    Scope
    16 vulnerabilities in this advisory, including CVE-2026-66801.
    CVE-2026-66801

    A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.

    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Fixed: 4 products Known not affected: 13 products
    https://access.redhat.com/errata/RHSA-2026:53530
    Open the full advisory

    RHSA-2026:54392

    Vulnerability from csaf_redhat - Published: 2026-08-12 14:31 - Updated: 2026-09-24 08:03
    Summary
    Red Hat Security Advisory: Multicluster Global Hub 1.6.5 security update
    Severity
    Critical
    Scope
    3 vulnerabilities in this advisory, including CVE-2026-66801.
    CVE-2026-66801

    A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.

    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Fixed: 4 products Known not affected: 17 products
    https://access.redhat.com/errata/RHSA-2026:54392
    Open the full advisory

    RHSA-2026:54577

    Vulnerability from csaf_redhat - Published: 2026-08-13 13:01 - Updated: 2026-09-24 08:03
    Summary
    Red Hat Security Advisory: Multicluster Global Hub 1.5.7 security update
    Severity
    Critical
    Scope
    3 vulnerabilities in this advisory, including CVE-2026-66801.
    CVE-2026-66801

    A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.

    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Fixed: 4 products Known not affected: 17 products
    https://access.redhat.com/errata/RHSA-2026:54577
    Open the full advisory

    RHSA-2026:55810

    Vulnerability from csaf_redhat - Published: 2026-08-17 16:44 - Updated: 2026-09-24 08:03
    Summary
    Red Hat Security Advisory: Multicluster Global Hub 1.4.8 security update
    Severity
    Critical
    Scope
    5 vulnerabilities in this advisory, including CVE-2026-66801.
    CVE-2026-66801

    A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.

    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Fixed: 4 products Known not affected: 17 products
    https://access.redhat.com/errata/RHSA-2026:55810
    Open the full advisory