CVE-2026-4740 affects Red Hat Multicluster Engine for Kubernetes through a flaw in Open Cluster Management (OCM). The vulnerability arises from improper validation of Kubernetes client certificate renewal requests. This weakness allows a managed cluster administrator to forge a client certificate that the OCM controller may approve, leading to cross-cluster privilege escalation. Consequently, an attacker could gain control over other managed clusters, including the hub cluster that orchestrates management. The CVSS 3.1 base score is 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been confirmed in the vendor advisory as of the current data.

The vulnerability allows a managed cluster administrator to forge client certificates that can be accepted by the OCM controller, enabling privilege escalation across clusters. This can lead to an attacker gaining control over multiple managed clusters, including the hub cluster, which could compromise the confidentiality, integrity, and availability of cluster resources and workloads. The CVSS score of 8.2 reflects a high severity impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4740 for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor managed cluster administrator privileges to reduce risk. No vendor advisory states that no action is required or that the issue is already mitigated.