CVE-2026-4740highCWE-295

CVE-2026-4740: high-severity vulnerability in Red Hat Multicluster Engine for Kubernetes

Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

Published · Updated

Follow this CVE+ Monitor multicluster engine for Kubernetes+ Monitor open-cluster-management.io/ocm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.1%
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Red Hat · Multicluster Engine for KubernetesRed Hat · multicluster engine for Kubernetes 2.1Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9
Related CVEs — Red Hat Multicluster Engine for Kubernetes

In the same product, most dangerous first.

CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2026-73268CRITICALCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionEPSS 0.9%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%