CVE-2026-54100
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Windows Machine Config Operator (WMCO) for Red Hat OpenShift establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker can intercept or redirect the SSH session to capture WICD and kubelet bootstrap credentials.
Risk Assessment
The risk involves potential compromise of Windows node identities in the cluster, leading to unauthorized access and privilege escalation within the OpenShift environment.
Recommendation
Immediately update WMCO to a version that verifies SSH host keys and implement network protections such as segmentation and SSH traffic monitoring.
Original NVD description (English source)
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.