CVE-2026-54100 | BDVDB-2026-342106 Detail
Red HatRed Hat OpenShift for Windows Containers 10.19
Description#
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: adjacent.
Weaknesses#
- CWE-295 Improper Certificate Validation
References#
- https://access.redhat.com/errata/RHSA-2026:47173
- https://access.redhat.com/errata/RHSA-2026:61780
- https://access.redhat.com/errata/RHSA-2026:81397
- https://access.redhat.com/errata/RHSA-2026:82440
- https://access.redhat.com/security/cve/CVE-2026-54100
- https://bugzilla.redhat.com/show_bug.cgi?id=2487953
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54100.json
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.