Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-4740 Details

Description

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:8.2 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:11414 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:13542 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:13853 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:8218 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:9848 redhat-SADP

see all 16 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-295Improper Certificate Validationredhat-SADP
CWE-295Improper Certificate Validation[email protected]

Affected Products

ProductVersions
redhat advanced cluster management for kubernetes
All versions

CPE

  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

33 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-4740
NVD Published Date:
Apr 7, 2026
NVD Last Modified:
Sep 8, 2026
Source:
[email protected]
CVE-2026-4740 Details - Not Deferred