CVE-2026-4740

[CVE catalog]

Severity

High · CVSS 8.2CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Published

Apr 7, 2026, 2:00:35 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.15% · Oct 25, 2026

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster. rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation Improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM), allows a managed cluster administrator to forge a client certificate. This could lead to cross-cluster privilege escalation, potentially enabling an attacker to gain control over other managed clusters, including the hub cluster. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.