CVE-2026-4740: Red Hat ACM/OCM Cross-cluster Privilege Escalation via Certificate Validation

Vulnerability Overview CVE ID: CVE-2026-4740 Vulnerability Name: rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation Detailed Description: An improper validation issue exists in Open Cluster Management (OCM), the underlying technology of Red Hat Advanced Cluster Management (ACM), regarding Kubernetes client certificate renewal. This allows administrators of managed clusters to forge client certificates that can be approved by the OCM controller. Due to a predictable cluster name prefix matching mechanism, attackers can exploit this vulnerability to achieve cross-cluster privilege escalation, potentially gaining control over other managed clusters, including the hub cluster. Scope of Impact Affected Products: Red Hat Advanced Cluster Management (ACM) / Open Cluster Management (OCM) Affected Roles: Administrators of managed clusters Potential Consequences: Cross-cluster privilege escalation; attackers may gain control over other managed clusters and the hub cluster. Remediation Remediation Direction: Fix the improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM) (Improve validation of Kubernetes client certificate renewal). Specific Patches: The provided screenshot does not contain specific patch code or remediation steps; it only indicates the need to fix the validation logic to prevent certificate forgery.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-4740: Red Hat ACM/OCM Cross-cluster Privilege Escalation via Certificate Validation