Security readout for executives and security teams
Plain-English summary
This issue could let an administrator on one managed cluster abuse Open Cluster Management certificate renewal handling to gain privileges across other managed clusters, possibly including the hub. That turns a contained cluster-admin compromise into a broader platform-control risk.
Executive priority
Treat this as high priority where ACM or MCE manages multiple production clusters. The business risk is privilege expansion from one cluster into the broader fleet, including potential hub impact. Prioritize inventory, vendor guidance, and access review.
Technical view
OCM, underlying Red Hat ACM, improperly validates Kubernetes client certificate renewals. A managed cluster administrator may forge a client certificate that the OCM controller approves, enabling cross-cluster privilege escalation. The source maps this to CWE-295 and CVSS 8.2 with changed scope and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations using Red Hat Advanced Cluster Management or Multicluster Engine for Kubernetes with OCM-managed clusters are the likely exposure group. The bundle names multiple multicluster-engine packages, but does not provide affected version ranges.
Exploitation context
The CVSS vector indicates local access, low complexity, high privileges, and no user interaction. The attacker already needs managed cluster administrator privileges. KEV is false, and the supplied sources do not state active exploitation in the wild.
Researcher notes
Public evidence supports the vulnerability class, impact, affected product family, and severity. Affected version ranges, fixed package versions, and exploitation telemetry are incomplete in the supplied bundle, so validation should lean on Red Hat’s CVE, Bugzilla, and CSAF VEX records.
Mitigation direction
- Review Red Hat CVE and CSAF VEX guidance for affected and fixed builds.
- Apply Red Hat-provided updates when available for multicluster-engine components.
- Limit managed cluster administrator access to trusted operators only.
- Monitor certificate renewal and approval workflows for unexpected identities.
- Review hub and managed cluster trust boundaries after any cluster-admin compromise.
Validation and detection
- Inventory Red Hat ACM and Multicluster Engine deployments using OCM.
- Compare installed multicluster-engine packages against Red Hat CSAF VEX status.
- Review who has administrator rights on each managed cluster.
- Audit certificate approval logs for unusual renewal patterns or identities.
- Check for unexpected cross-cluster administrative actions after certificate renewals.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-4740 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H1.56redhatCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H1.56redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- ADP timelineredhat-SADP
Reported to Red Hat.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-24T03:18:24.150Z: Reported to Red Hat.
- 2026-04-07T14:00:35.240Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2026-4740CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/CVE reference, redhat
- RHBZ#2450590CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.