Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-4740

CVE-2026-4740HIGH

Red Hat multicluster engine for Kubernetes 2.1 — Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   H   N  C  H  H  H    8.2   .0016    5.0     —

AFFECTED
  Product                                  Versions     Fixed
  multicluster engine for Kubernetes 2.1   unspecified  1776881164
  multicluster engine for Kubernetes 2.11  unspecified  1777478390
  multicluster engine for Kubernetes 2.6   unspecified  1775977180
  multicluster engine for Kubernetes 2.8   unspecified  1775638726
  multicluster engine for Kubernetes 2.9   unspecified  1776445095
  Multicluster Engine for Kubernetes       unspecified  —
  Multicluster Engine for Kubernetes       unspecified  —
  Multicluster Engine for Kubernetes       unspecified  —
  Multicluster Engine for Kubernetes       unspecified  —
  Multicluster Engine for Kubernetes       unspecified  —
  + 1 more

TIMELINE
  Mar 24  Reserved by redhat
  Apr 7   Published (CNA: redhat)
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
  Aug 25  EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.10). Public exploit reference added.
  Sep 5   EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
  Sep 7   EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
  Sep 8   EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.

CWE-295 · CNA: redhat · CVSS v3.1 · 9 references · NVD status: Modified

Description

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Lifecycle

Complete event history — 7 events, chronological
Date	Event	Detail
March 24, 2026	Reserved	Reserved by redhat
April 7, 2026	Published	Published (CNA: redhat)
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
August 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.10). Public exploit reference added.
September 5, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
September 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.
September 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.

Affected

Affected products and packages — 11 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	multicluster engine for Kubernetes 2.1	—	—	1776881164
Red Hat	multicluster engine for Kubernetes 2.11	—	—	1777478390
Red Hat	multicluster engine for Kubernetes 2.6	—	—	1775977180
Red Hat	multicluster engine for Kubernetes 2.8	—	—	1775638726
Red Hat	multicluster engine for Kubernetes 2.9	—	—	1776445095
Red Hat	Multicluster Engine for Kubernetes	—	—	—
Red Hat	Multicluster Engine for Kubernetes	—	—	—
Red Hat	Multicluster Engine for Kubernetes	—	—	—
Red Hat	Multicluster Engine for Kubernetes	—	—	—
Red Hat	Multicluster Engine for Kubernetes	—	—	—
Red Hat	Multicluster Engine for Kubernetes	—	—	—

Weaknesses

CWE-295

References (9)

https://access.redhat.com/errata/RHSA-2026:11414 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13542 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13853 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:8218 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:9848 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-4740 [vdb-entry, x_refsource_REDHAT]
https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/
https://bugzilla.redhat.com/show_bug.cgi?id=2450590 [issue-tracking, x_refsource_REDHAT]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json [x_sadp-csaf-vex]

Authoritative record: CVE-2026-4740 at cve.org

Vendors: red hat

Weaknesses: CWE-295

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-4740 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.