Skip to content
fr Sign in
8.2 High

CVE-2026-4740 A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM)

Description

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Affected products and versions

Product Affected versions Fixed in
Multicluster Engine for Kubernetes Versions not published
multicluster engine for Kubernetes 2.11 1777478390 earliest → < 1777478390 1777478390
multicluster engine for Kubernetes 2.6 1775977180 earliest → < 1775977180 1775977180
multicluster engine for Kubernetes 2.9 1776445095 earliest → < 1776445095 1776445095
multicluster engine for Kubernetes 2.1 1776881164 earliest → < 1776881164 1776881164
multicluster engine for Kubernetes 2.8 1775638726 earliest → < 1775638726 1775638726
multicluster engine for Kubernetes 2.10 1776881164 earliest → < 1776881164 1776881164
multicluster engine for Kubernetes 2.11.0 1777478390 earliest → < 1777478390 1777478390
multicluster engine for Kubernetes 2.9.0 1776445095 earliest → < 1776445095 1776445095

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Multicluster Engine for Kubernetes

The 79 CVEs of Multicluster Engine for Kubernetes →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… 3.3 Low CVE-2026-71297 A flaw was found in the maestro gRPC broker 5.4 Medium CVE-2026-71299 A flaw was found in Maestro 6.5 Medium
Track this CVE