CVE-2026-66801
Description
A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared gh-spec topic. This message can spoof its source as "global-hub" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs.
Statement
Critical: The default Strimzi transport in Multicluster Global Hub is vulnerable to privilege escalation. A compromised managed hub can exploit weak Kafka Write ACLs on the shared gh-spec topic and spoofed CloudEvent sources to gain cluster-admin privileges across the entire fleet of managed hubs. This allows an attacker to achieve fleet-wide administrative control from a single compromised leaf hub.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
9.9 Critical. PR:L — attacker needs authenticated access to any one managed hub (namespace-admin or compromised agent pod). S:C — compromised hub-A's Kafka principal is scoped to hub-A, but the attack crosses into hub-B and all other managed hubs fleet-wide. AC:L — no race conditions or special configuration needed; the shared Write ACL on gh-spec and the absent principal-to-source binding are default-on in Strimzi transport mode.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
