EUVD-2026-19690
GHSA-q4gv-pjmh-c735
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
5DescriptionCVE.org
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
AnalysisAI
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.
Technical ContextAI
Open Cluster Management (OCM) is the upstream technology powering Red Hat Advanced Cluster Management, providing multi-cluster orchestration for Kubernetes environments. The vulnerability stems from CWE-295 (Improper Certificate Validation) in the OCM controller's handling of Kubernetes client certificate renewal requests. In a hub-and-spoke architecture, managed clusters authenticate to the hub using client certificates. The flaw allows a compromised managed cluster administrator to craft malicious certificate signing requests that bypass validation controls during the renewal process. Once the forged certificate is approved by the automated OCM controller, the attacker gains authenticated access as a trusted cluster identity, breaking the isolation boundary between managed clusters. This affects Red Hat Multicluster Engine for Kubernetes deployments where the hub cluster manages multiple spoke clusters through certificate-based mutual TLS authentication.
RemediationAI
Organizations should immediately apply vendor-released patches for Red Hat Multicluster Engine for Kubernetes and Advanced Cluster Management as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4740. Consult the Bugzilla tracking issue at https://bugzilla.redhat.com/show_bug.cgi?id=2450590 for specific fixed versions and update instructions. Until patching is complete, implement defense-in-depth controls including enhanced monitoring of certificate signing requests from managed clusters, audit logging of cross-cluster authentication attempts, and network segmentation to limit lateral movement between managed clusters. Review and restrict administrative access to managed clusters, treating any cluster administrator as a potential pivot point to the hub. Consider temporarily isolating high-risk or less-trusted managed clusters from the hub environment if immediate patching is not feasible. Post-remediation, rotate all cluster client certificates and review audit logs for suspicious certificate approval activity dating back to when vulnerable versions were deployed.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today