{"action":"Upgrade open-cluster-management.io/ocm to 1.2.1 or later.","affected":[{"fixed":"1.2.1","introduced":"0"}],"component":"open-cluster-management.io/ocm","cve_ids":["CVE-2026-4740"],"ecosystem":"Go","epss":0.00148,"exploited":false,"fixed_versions":["1.2.1"],"ghsa_id":"GHSA-q4gv-pjmh-c735","id":"tcs_01M5KFJ9D5FZCM9JQ27QCJVSWB","modified_at":"2026-06-25T23:11:37.113218915Z","published_at":"2026-04-07T15:30:52Z","references":["https://osv.dev/vulnerability/GHSA-q4gv-pjmh-c735","https://nvd.nist.gov/vuln/detail/CVE-2026-4740","https://github.com/open-cluster-management-io/ocm/commit/9e70cc1e21a15239c81111062c0b37df4b5a8026","https://access.redhat.com/security/cve/CVE-2026-4740","https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape","https://bugzilla.redhat.com/show_bug.cgi?id=2450590","https://github.com/open-cluster-management-io/OCM"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-q4gv-pjmh-c735","url":"https://osv.dev/vulnerability/GHSA-q4gv-pjmh-c735"}],"summary":"Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation"}