{"id":"GO-2026-5564","revision":"4c61ec1c627c4343839f409668fb98ab","records":[{"revision":"4c61ec1c627c4343839f409668fb98ab","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5564","aliases":["CVE-2026-4740","GHSA-q4gv-pjmh-c735"],"title":"Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm","description":"Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:31.58469+00:00","affected":[{"ecosystem":"Go","name":"open-cluster-management.io/ocm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-q4gv-pjmh-c735","https://nvd.nist.gov/vuln/detail/CVE-2026-4740","https://access.redhat.com/security/cve/CVE-2026-4740","https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape","https://bugzilla.redhat.com/show_bug.cgi?id=2450590","https://github.com/open-cluster-management-io/ocm/commit/9e70cc1e21a15239c81111062c0b37df4b5a8026"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5564","license":"OSV · upstream source license applies","key":"osv:GO-2026-5564","identifiers":["GO-2026-5564","CVE-2026-4740","GHSA-q4gv-pjmh-c735"]},"retained":false,"historicalAffected":[]}],"coverage":[]}