# CVE-2026-4740: Open Cluster Management privilege escalation in certificate renewal validation

Source: https://junglewise.ai/threats/cve-2026-4740-open-cluster-management-privilege-escalation-in-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4740 · Severity: high · CVSS 8.2 · Published 2026-04-07

A security flaw was found in Open Cluster Management, a tool used to manage multiple Kubernetes environments from a single central hub. An administrator of one managed environment could exploit a weakness in how security certificates are renewed to trick the system into granting them access to other environments. This could allow an attacker to take control of the entire fleet of clusters, including the central management hub, potentially leading to a total compromise of data and operations across the organization.

Technologies: [Redhat Advanced Cluster Management For Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-management-for-kubernetes). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-4740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4740 being exploited in the wild.

**How severe is CVE-2026-4740?** High severity, with a CVSS score of 8.2, published 7 April 2026.

**Which products and versions are affected?** open-cluster-management.io/ocm (Go) SEMVER:introduced=0,fixed=1.2.1; Open Cluster Management < 1.2.1, < 1.1.3, < 1.0.1.

**Is there a fix for CVE-2026-4740?** Yes. open-cluster-management.io/ocm (Go): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4740 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-4740?** Check whether you run open-cluster-management.io/ocm (Go), Open Cluster Management or Redhat Advanced Cluster Management For Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-cluster-management.io/ocm (Go): upgrade to 1.2.1 or later

  ```sh
  go get open-cluster-management.io/ocm@v1.2.1
  ```


## Technical details

A vulnerability exists in the Open Cluster Management (OCM) controller's CertificateSigningRequest (CSR) validation logic. The 'csrRenewalReconciler' component fails to properly validate certificate renewal requests, specifically due to predictable cluster name prefix matching. An attacker with administrative access to a managed cluster can forge a client certificate that the OCM controller will incorrectly approve. This enables cross-cluster privilege escalation, allowing the attacker to gain unauthorized access to other managed clusters or the hub cluster itself. The issue was addressed in OCM versions 1.2.1, 1.1.3, and 1.0.1.

## Affected products

- Open Cluster Management Open Cluster Management (OCM) < 1.2.1, < 1.1.3, < 1.0.1
- Red Hat Advanced Cluster Management for Kubernetes (ACM)
- Red Hat Multicluster Engine for Kubernetes (MCE)

## Identifiers

- CVE-2026-4740
- GHSA-q4gv-pjmh-c735
- GO-2026-5564

## Timeline

- 2026-02-02: disclosed: Vulnerability reported to Red Hat Security Team
- 2026-04-07: advisory: CVE-2026-4740 disclosed with a CVSS score of 8.2
- 2026-04-10: patched: Patches released in OCM 1.2.1, 1.1.3, and 1.0.1

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-4740](https://access.redhat.com/security/cve/CVE-2026-4740)
- [https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/](https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2450590](https://bugzilla.redhat.com/show_bug.cgi?id=2450590)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json)

## Related threats

- [Red Hat insights-client excessive Kubernetes permissions in ServiceAccount](https://junglewise.ai/threats/cve-2026-71846-red-hat-insights-client-excessive-kubernetes-permissions-in)
- [A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it…](https://junglewise.ai/threats/cve-2026-71845-a-flaw-was-found-in-insights-client-the-setdefault-function-logs)
- [A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded…](https://junglewise.ai/threats/cve-2026-71475-a-flaw-was-found-in-insights-client-a-compromised-managed-cluster)
- [A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers…](https://junglewise.ai/threats/cve-2026-71474-a-flaw-was-found-in-insights-client-when-the-application-receives)
- [Red Hat Multicluster Engine for Kubernetes privilege escalation in /etc/passwd](https://junglewise.ai/threats/cve-2025-57851-red-hat-multicluster-engine-for-kubernetes-privilege-escalation)