CVE-2026-4740Disclosure(redhat / advanced_cluster_management_for_kubernetes)

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

redhat CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-295

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

advanced_cluster_management_for_kubernetes

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-07); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

redhat

Products

advanced_cluster_management_for_kubernetes

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

PulsePatch.io@pulsepatchio184d
Disclosure
A privilege escalation flaw (CVE-2026-4740) in `Open Cluster Management (OCM)` permits cross-cluster access via improper Kubernetes client certificate renewal validation. #Kubernetes #OCM #SecurityAdvisory https://www.pulsepatch.io/posts/cve-2026-4740-open-cluster-management-privilege-escalation
Post summary
The post is a disclosure of CVE‑2026‑4740, a privilege escalation vulnerability in Open Cluster Management that allows cross‑cluster access via flawed Kubernetes client certificate renewal validation.
0000028
11 followersView on X
CVE@CVEnew185d
Disclosure
CVE-2026-4740 A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certifi… https://www.cve.org/CVERecord?id=CVE-2026-4740
Post summary
A flaw was discovered in Open Cluster Management involving improper validation of Kubernetes client certificates; no PoC, exploit code, or patch details are provided.
00000166
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	redhat	advanced_cluster_management_for_kubernetes	-	-	-

Explore more

Back to dashboard redhat CVEs advanced_cluster_management_for_kubernetes vulnerabilities