HighPublic exploit

Cross-cluster privilege escalation in Open Cluster Management certificate renewal validation

IdentifiersCVE-2026-4740CWE-295· Improper Certificate Validation

CVE-2026-4740 is an improper certificate validation flaw in Open Cluster Management (OCM), which underlies Red Hat Advanced Cluster Management (ACM) and Red Hat Multi Cluster Engine. The issue affects the Kubernetes client certificate renewal flow used by managed-cluster agents to authenticate to the hub cluster. According to the provided content, the vulnerable CertificateSigningRequest approval logic on the hub validates certificate identity fields using a prefix-based comparison derived from a user-controlled label/server-name calculation rather than enforcing an exact match between the requesting managed cluster identity and the cluster name embedded in the certificate request. As a result, an administrator of one managed cluster can craft a forged CSR for another cluster whose name shares the relevant prefix, obtain approval from the OCM controller, and receive a valid client certificate for the target cluster identity. The forged credentials can then be used to interact with hub-side OCM resources such as ManifestWork and pivot into other managed clusters or the hub itself.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation enables cross-cluster privilege escalation from one managed cluster to other managed clusters and potentially to the hub cluster. An attacker who already has administrator access on a managed cluster can impersonate another cluster's agent identity, patch or abuse ManifestWork distribution, and deploy privileged resources such as a ClusterRoleBinding on the victim cluster. This can result in full administrative control of the victim managed cluster and may extend to compromise of the hub cluster, with high impact to confidentiality, integrity, and availability across the cluster fleet.

Mitigation

If you can’t patch tonight, do this now.

Until fixes are applied, reduce exposure by tightly restricting administrator access on managed clusters, since exploitation requires managed-cluster admin privileges. Audit and limit access to hub kubeconfig secrets stored in agent namespaces on managed clusters. Review cluster naming conventions to avoid predictable or overlapping prefix relationships that could facilitate impersonation, and closely monitor hub CSR approvals, ManifestWork modifications, and unexpected ClusterRoleBinding deployments. Where operationally feasible, constrain network paths and API access between managed clusters and the hub, and prioritize protection of hub clusters named with predictable defaults such as "local-cluster."

Remediation

Patch, then assume compromise.

Apply the vendor-provided fixes from Red Hat/Open Cluster Management for CVE-2026-4740 so that CSR approval enforces exact cluster identity validation during Kubernetes client certificate renewal. Because the issue affects OCM and downstream products that depend on it, update affected Open Cluster Management, Red Hat Advanced Cluster Management, and Red Hat Multi Cluster Engine deployments to the corrected releases referenced by the vendor advisory. After patching, rotate or reissue potentially exposed agent credentials and review previously approved CSRs and ManifestWork changes for signs of abuse.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Red HatAdvanced Cluster Management For Kubernetesapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

cvefeed high severityNews

Apr 7, 2026

CVE-2026-4740 - Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

A privilege escalation vulnerability in Open Cluster Management (OCM) / Red Hat Advanced Cluster Management (ACM) caused by improper validation of Kubernetes client certificate renewal, enabling forged client certificates and cross-cluster compromise.

zeropath blogNews

Apr 7, 2026

Open Cluster Management CVE-2026-4740: Brief Summary of Cross Cluster Privilege Escalation via Certificate Renewal Flaw - ZeroPath Blog | ZeroPath

An improper certificate validation vulnerability in Open Cluster Management CSR approval logic that allows an administrator of one managed cluster to forge certificates and escalate privileges across other managed clusters and the hub cluster.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5