Skip to content
Fencer Vulns
high 8.2

CVE-2026-4740 json

Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

published 2026-04-07 7 mo ago modified 2026-10-26 13 d ago also GHSA-q4gv-pjmh-c735 , GO-2026-5564 , EUVD-2026-19690

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Patch / fix

  • go open-cluster-management.io/ocm 1.2.1
  • Red Hat multicluster engine for Kubernetes 2.1 1776881164
  • Red Hat multicluster engine for Kubernetes 2.11 1777478390
  • Red Hat multicluster engine for Kubernetes 2.6 1775977180
  • Red Hat multicluster engine for Kubernetes 2.8 1775638726
  • Red Hat multicluster engine for Kubernetes 2.9 1776445095
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4740 updated cvss 8.2

rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicluster-engine/maestro-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/registration-operator-rhel9, multicluster-engine/managedcluster-import-controller-rhel9
    under investigation
  • Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine 1776881164
    fixed: vendor fix RHSA-2026:13542
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1775977180
    fixed: vendor fix RHSA-2026:9848
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1775638726
    fixed: vendor fix RHSA-2026:8218
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1776445095
    fixed: vendor fix RHSA-2026:11414
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine 1777478390
    fixed: vendor fix RHSA-2026:13853
  • Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine 1776426991, multicluster-engine 1776449110, multicluster-engine 1776457396, multicluster-engine 1776556092, multicluster-engine 1776641944, multicluster-engine 1776729146, +23 more Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1775678862, multicluster-engine 1775691793, multicluster-engine 1775691813, multicluster-engine 1775736638, multicluster-engine 1775778326, multicluster-engine 1775826440, +20 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1774913604, multicluster-engine 1774913615, multicluster-engine 1774913637, multicluster-engine 1774913693, multicluster-engine 1774913711, multicluster-engine 1774913767, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1776296924, multicluster-engine 1776435357, multicluster-engine 1776445106, multicluster-engine 1776445130, multicluster-engine 1776555850, multicluster-engine 1776729038, +23 more Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine 1776641882, multicluster-engine 1776819586, multicluster-engine 1776987414, multicluster-engine 1777025931, multicluster-engine 1777073850, multicluster-engine 1777073865, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • blog.arfevrier.fr https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADP 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go open-cluster-management.io/ocm
<1.2.1
1.2.1

Affected products

  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Multicluster Engine for Kubernetes

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.