Red Hat Multicluster Global Hub 1.4.9 vulnerabilities

3 CVEs affecting Red Hat Multicluster Global Hub 1.4.9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66792, published 2026-08-17.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-66792, published 2026-08-17. Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific,…
• CVE-2026-71577, published 2026-08-10. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised…
• CVE-2026-71576, published 2026-08-10. High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a…