CVE-2026-54099

HighCVSS 8.8

Published: 22/06/2026(UTC)Updated: 05/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

A flaw in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows the WICD CSR auto-approver to validate the presence of the 'system:wicd-nodes' organization but not reject additional organizations like 'system:masters'. A compromised Windows worker node with WICD credentials can obtain a client certificate with cluster-admin privileges, leading to full cluster takeover.

Risk Assessment

A compromised Windows node can escalate privileges to cluster administrator, enabling complete control over the OpenShift cluster.

Recommendation

Update WMCO to the patched version immediately and review the CSR auto-approval configuration to reject requests with unauthorized organization values.

Other vulnerabilities in Windows Machine Config Operator

CVE-2026-54100High
The Windows Machine Config Operator (WMCO) for Red Hat OpenShift establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker can intercept or redirect the SSH session to capture WICD and kubelet bootstrap credentials.

Original NVD description (English source)

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.