Read the docs
TI-2026-04135 Aliases CVE-2026-4740GHSA-q4gv-pjmh-c735

Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1

Priority LOW 37CWE-295Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00151 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial open-cluster-management.io/ocm (Go): 1.2.1Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatmulticluster engine for Kubernetes 2.1—1776881164Patch availableCNA
Red Hatmulticluster engine for Kubernetes 2.11—1777478390Patch availableCNA
Red Hatmulticluster engine for Kubernetes 2.6—1775977180Patch availableCNA
Red Hatmulticluster engine for Kubernetes 2.8—1775638726Patch availableCNA
Red Hatmulticluster engine for Kubernetes 2.9—1776445095Patch availableCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
Red HatMulticluster Engine for Kubernetes——No fix listedCNA
—open-cluster-management.io/ocm (Go)before 1.2.11.2.1Patch availableGHSA-q4gv-pjmh-c735
  • multicluster engine for Kubernetes 2.1 VendorRed Hat Affected — Fixed in 1776881164 Patch available CNA
  • multicluster engine for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1777478390 Patch available CNA
  • multicluster engine for Kubernetes 2.6 VendorRed Hat Affected — Fixed in 1775977180 Patch available CNA
  • multicluster engine for Kubernetes 2.8 VendorRed Hat Affected — Fixed in 1775638726 Patch available CNA
  • multicluster engine for Kubernetes 2.9 VendorRed Hat Affected — Fixed in 1776445095 Patch available CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — No fix listed CNA
  • open-cluster-management.io/ocm (Go) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-q4gv-pjmh-c735

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-q4gv-pjmh-c735 open-cluster-management.io/ocm (Go) Fixed in 1.2.1 Advisory →

Red Hat 5 advisories

  • RHSA-2026:13853 Released 2026-05-05 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.1 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/registration-rhel9
  • RHSA-2026:13542 Released 2026-05-04 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.2 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:11414 Released 2026-04-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.3 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
Show 2 more Red Hat advisories
  • RHSA-2026:9848 Released 2026-04-22 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.10 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:8218 Released 2026-04-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.5 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffected—
multicluster engine for Kubernetes 2.1Fixed RHSA-2026:13542
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:13853
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:9848
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:8218
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:11414
Not affected: 5 products
  • multicluster engine for Kubernetes 2.1
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4740
  2. 2026-10-03 Alias added: GHSA-q4gv-pjmh-c735

References

Exploit 1

Advisory 8

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-10313 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… CVSS 3.1HIGH 7.5
  • TI-2022-03521 Server-side request forgery in Red Hat RHACM CVSS 3.1HIGH 7.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences