Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-4740
Modified
More InfoOfficial Page
Source-secalert@redhat.com
View Known Exploited Vulnerability (KEV) details
Published At-07 Apr, 2026 | 15:17
Updated At-15 Jul, 2026 | 02:22

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.2HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Secondary3.18.2HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
N/A
Type: Secondary
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches
Red Hat, Inc.
redhat
>>advanced_cluster_management_for_kubernetes>>-
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-295Secondarysecalert@redhat.com
CWE-295Secondary0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CWE ID: CWE-295
Type: Secondary
Source: secalert@redhat.com
CWE ID: CWE-295
Type: Secondary
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://access.redhat.com/security/cve/CVE-2026-4740secalert@redhat.com
Vendor Advisory
https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/secalert@redhat.com
Exploit
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450590secalert@redhat.com
Issue Tracking
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-47400b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=24505900b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue Tracking
Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json0b0ca135-0b70-47e7-9f44-1890c2a1c46c
N/A
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-4740
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/
Source: secalert@redhat.com
Resource:
Exploit
Third Party Advisory
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2450590
Source: secalert@redhat.com
Resource:
Issue Tracking
Vendor Advisory
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-4740
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Resource:
Vendor Advisory
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2450590
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Resource:
Issue Tracking
Vendor Advisory
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Resource: N/A
Change History
0Changes found
Details not found