CVE-2026-4740: Rhacm: open cluster management (ocm): cross-cluster privilege escalation vi

Description

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat multicluster engine for Kubernetes 2.1

Default version status: affected

1776881164 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.11

Default version status: affected

1777478390 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.6

Default version status: affected

1775977180 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.8

Default version status: affected

1775638726 to < *unaffected