Improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM) allows a managed‑cluster administrator to forge a client certificate that the OCM controller will approve. The forged certificate can be used to impersonate higher‑privilege identities across clusters, enabling the attacker to gain control over the hub cluster and any other managed clusters in the environment. The vulnerability leads to a full compromise of confidentiality, integrity, and availability for all clusters connected through OCM.

Red Hat Multicluster Engine for Kubernetes is the affected product. No specific affected version information was supplied, so any installation of this product should be evaluated to determine if it is running an unpatched version of OCM.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, but the lack of a KEV listing suggests it is not a widely discovered exploit yet. The most likely attack vector is an internal one; an attacker who has administrative privileges on a managed cluster can forge a certificate and submit it for renewal. If the OCM controller accepts the forged certificate, the attacker can then perform actions on the hub and other clusters with elevated privileges. The exploit does not require external network access beyond the normal OCM traffic. Given the severity and potential impact, the risk is considered high.