What is the CVSS score of CVE-2026-4740?

CVE-2026-4740 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Kubernetes are affected by CVE-2026-4740?

Red Hat Open Cluster Management (OCM) and Multicluster Engine for Kubernetes contain a certificate validation flaw that enables privileged cluster administrators to forge credentials and escalate…. A patch is available.

How to fix or mitigate CVE-2026-4740?

Within 24 hours: Inventory all Red Hat OCM and Multicluster Engine deployments across your infrastructure; identify administrators with local cluster access and document their current privileges. Within 7 days: Contact Red Hat support for patch availability timeline and interim guidance; implement access control review for high-privilege administrative accounts across all managed clusters. Within 30 days: Apply vendor-released patch immediately upon availability; conduct forensic review of administrator account activity logs for certificate issuance anomalies; re-credential all service accounts and client certificates issued within the past 90 days.

Kubernetes CVE-2026-4740

EUVD-2026-19690 HIGH

Improper Certificate Validation (CWE-295)

2026-04-07 redhat

GHSA-q4gv-pjmh-c735

Privilege Escalation Red Hat Kubernetes Multicluster Engine For Kubernetes

8.2

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:53 vuln.today

cvss_changed

Patch released

Apr 09, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19690

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:30 nvd

HIGH 8.2

DescriptionCVE.org

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

AnalysisAI

Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.

Technical ContextAI

Open Cluster Management (OCM) is the upstream technology powering Red Hat Advanced Cluster Management, providing multi-cluster orchestration for Kubernetes environments. The vulnerability stems from CWE-295 (Improper Certificate Validation) in the OCM controller's handling of Kubernetes client certificate renewal requests. In a hub-and-spoke architecture, managed clusters authenticate to the hub using client certificates. The flaw allows a compromised managed cluster administrator to craft malicious certificate signing requests that bypass validation controls during the renewal process. Once the forged certificate is approved by the automated OCM controller, the attacker gains authenticated access as a trusted cluster identity, breaking the isolation boundary between managed clusters. This affects Red Hat Multicluster Engine for Kubernetes deployments where the hub cluster manages multiple spoke clusters through certificate-based mutual TLS authentication.

RemediationAI

Organizations should immediately apply vendor-released patches for Red Hat Multicluster Engine for Kubernetes and Advanced Cluster Management as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4740. Consult the Bugzilla tracking issue at https://bugzilla.redhat.com/show_bug.cgi?id=2450590 for specific fixed versions and update instructions. Until patching is complete, implement defense-in-depth controls including enhanced monitoring of certificate signing requests from managed clusters, audit logging of cross-cluster authentication attempts, and network segmentation to limit lateral movement between managed clusters. Review and restrict administrative access to managed clusters, treating any cluster administrator as a potential pivot point to the hub. Consider temporarily isolating high-risk or less-trusted managed clusters from the hub environment if immediate patching is not feasible. Post-remediation, rotate all cluster client certificates and review audit logs for suspicious certificate approval activity dating back to when vulnerable versions were deployed.