CVE-2026-4740 is a security vulnerability in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). The issue arises from improper validation of Kubernetes client certificate renewal, allowing a managed cluster administrator to forge a client certificate that the OCM controller may approve. This flaw enables cross-cluster privilege escalation, potentially allowing an attacker to gain control over other managed clusters, including the hub cluster. The vulnerability is associated with CWEs 295 (Improper Certificate Validation) and 915 (Improper Certificate Renewal). Red Hat has not released an official fix or patch that meets their criteria for ease of use, applicability, or stability. The CVSS v3.1 base score assigned by Red Hat is 8.2 (high), with attack vector local, low complexity, high privileges required, no user interaction, and changed scope. The impact includes high confidentiality, integrity, and availability impacts. Mitigation options are currently limited or unavailable. Red Hat recommends reviewing the advisory and monitoring for updates.

This vulnerability allows a managed cluster administrator to forge a Kubernetes client certificate that can be accepted by the OCM controller, enabling cross-cluster privilege escalation. An attacker exploiting this flaw could gain control over other managed clusters, including the central hub cluster, potentially compromising confidentiality, integrity, and availability of cluster management operations. The severity is high due to the broad impact on multiple clusters managed centrally.

As of the latest advisory, no official fix or patch meeting Red Hat's criteria for deployment and stability is available. Users should monitor Red Hat's advisories for updates and consider limiting administrative privileges on managed clusters to reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for tailored guidance. Applying mitigations is currently limited due to the nature of the vulnerability and lack of suitable workarounds.