CVE-2026-4740 Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation
A managed cluster administrator can forge client certificates to escalate privileges and control other managed clusters, including the hub cluster.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4740?
CVE-2026-4740 is a high-severity vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
Weakness: CWE-295
Which versions are affected by CVE-2026-4740?
3 open source packages ship an affected version, including open-cluster-management.io/ocm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
open-cluster-management.io/ocm Go | All versions | 1.2.1 |
open-cluster-management.io/ocm Go | All versions | 1.2.1 |
open-cluster-management.io/ocm Go | All versions | 1.2.1 |
Products include Redhat Advanced Cluster Management for Kubernetes.
How do I fix CVE-2026-4740?
Upgrade open-cluster-management.io/ocm to 1.2.1 or later.
Is CVE-2026-4740 being exploited?
There is no known exploitation of CVE-2026-4740 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Multicluster Engine for Kubernetes
- CVE-2023-3027 Privilege escalation in RHACM
- CVE-2022-3841 Server-side request forgery in RHACM
- CVE-2026-71474 Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
- CVE-2026-71475 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
- CVE-2026-71846 Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
Sources
Also known as GHSA-q4gv-pjmh-c735, GO-2026-5564.