A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-4740 | Vendor Advisory |
| https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/ | Exploit Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450590 | Issue Tracking Vendor Advisory |
Configurations
History
28 Apr 2026, 20:39
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Redhat advanced Cluster Management For Kubernetes |
|
| References | () https://access.redhat.com/security/cve/CVE-2026-4740 - Vendor Advisory | |
| References | () https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/ - Exploit, Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2450590 - Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:* |
07 Apr 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 15:17
Updated : 2026-04-28 20:39
NVD link : CVE-2026-4740
Mitre link : CVE-2026-4740
CVE.ORG link : CVE-2026-4740
JSON object : View
Products Affected
redhat
- advanced_cluster_management_for_kubernetes
CWE
CWE-295
Improper Certificate Validation