The vulnerability CVE-2026-4740 affects Red Hat Multicluster Engine for Kubernetes through improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM). This weakness allows a managed cluster administrator to forge a client certificate that the OCM controller may accept, leading to cross-cluster privilege escalation. Consequently, an attacker could potentially control other managed clusters, including the central hub cluster. The CVSS 3.1 base score is 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a high-severity issue with local attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. The vulnerability is published and tracked by Red Hat, but no patch or official remediation has been confirmed in the advisory content provided.

Successful exploitation of this vulnerability allows a managed cluster administrator to escalate privileges across clusters, potentially gaining control over multiple managed clusters including the hub cluster. This can lead to full compromise of cluster confidentiality, integrity, and availability. The impact is rated high due to the ability to affect multiple clusters and the critical nature of the control gained.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4740 for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor managed cluster administrator privileges to reduce risk. No vendor advisory content indicates that the issue is already mitigated or that no action is required.