CVE-2026-4740
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
Severity
HIGH
CVSS score
8.2
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-04-07 15:17:46.797000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-4740",
"sourceIdentifier": "[email protected]",
"published": "2026-04-07T15:17:46.797",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en Open Cluster Management (OCM), la tecnología subyacente a Red Hat Advanced Cluster Management (ACM). Una validación incorrecta de la renovación de certificados de cliente de Kubernetes permite a un administrador de clúster gestionado forjar un certificado de cliente que puede ser aprobado por el controlador de OCM. Esto permite la escalada de privilegios entre clústeres y puede permitir a un atacante obtener control sobre otros clústeres gestionados, incluyendo el clúster central."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.1",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"versions": [
{
"version": "1776881164",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"versions": [
{
"version": "1777478390",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"versions": [
{
"version": "1775977180",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"versions": [
{
"version": "1775638726",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"versions": [
{
"version": "1776445095",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/addon-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/maestro-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/placement-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/registration-operator-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/work-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.1",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"versions": [
{
"version": "1776881164",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"versions": [
{
"version": "1777478390",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"versions": [
{
"version": "1775977180",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"versions": [
{
"version": "1775638726",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/registration-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"versions": [
{
"version": "1776445095",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/addon-manager-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/maestro-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/placement-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/registration-operator-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
},
{
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "multicluster-engine/work-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-09T14:40:37.454585Z",
"id": "CVE-2026-4740",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7301AD20-0188-463F-9386-9D878AD3A542"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:11414",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13542",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13853",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8218",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:9848",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4740",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450590",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11414",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13542",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13853",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8218",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:9848",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4740",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450590",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}