CVE-2026-4740

highpriority · track · 0EPSS 0.002 · 5 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.16% (5th) EPSS

CVSS 8.2 · high

Is it mine?

7 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-24

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · secalert@redhat.com USexploitability 1.5 · impact 6

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 1.5 · impact 6

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USCWE-295US

affected products (7)

Products and version ranges known to be affected.

Red Hat multicluster engine for Kubernetes 2.1< 1776881164enisa_euvdEU
Red Hat multicluster engine for Kubernetes 2.11< 1777478390enisa_euvdEU
Red Hat multicluster engine for Kubernetes 2.6< 1775977180enisa_euvdEU
Red Hat multicluster engine for Kubernetes 2.8< 1775638726enisa_euvdEU
Red Hat multicluster engine for Kubernetes 2.9< 1776445095enisa_euvdEU
redhat advanced cluster management for kubernetesall versionsnvdUScpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
Go open-cluster-management.io/ocm< 1.2.1osvUSpkg:golang/open-cluster-management.io/ocm

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-q4gv-pjmh-c735Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation2026-04-07ghsa · osvUS
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
GO-2026-5564Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm2026-06-25vendor · osvUS
Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2026-04-07modified 2026-09-08

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan