CVE-2026-4740
Published: 07 April 2026
Summary
CVE-2026-4740 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Redhat Advanced Cluster Management For Kubernetes. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-17 (Public Key Infrastructure Certificates).
Deeper analysis
CVE-2026-4740 is a vulnerability in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). The flaw stems from improper validation of Kubernetes client certificate renewal, which allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. Published on 2026-04-07, it has a CVSS score of 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-295.
A managed cluster administrator can exploit this vulnerability locally with high privileges but low complexity and no user interaction required. Successful exploitation enables cross-cluster privilege escalation, potentially allowing the attacker to gain control over other managed clusters, including the hub cluster.
Red Hat's security advisory at https://access.redhat.com/security/cve/CVE-2026-4740, a related blog post at https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/, and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2450590 provide details on patches and mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19690
Vulnerability details
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by…
more
the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables cross-cluster privilege escalation by allowing a managed cluster administrator to forge an approved client certificate, granting unauthorized control over the hub cluster and other managed clusters.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and proper management of authenticators like client certificates prior to use, directly preventing forgery and improper renewal approval in OCM.
Mandates management and validation of PKI certificates in accordance with defined requirements, addressing the improper validation flaw in Kubernetes client certificate renewal.
Ensures timely identification, reporting, and correction of software flaws such as improper certificate validation through patching, mitigating cross-cluster privilege escalation.