CVE-2026-54099

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/errata/RHSA-2026:61780
https://access.redhat.com/security/cve/CVE-2026-54099	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487950	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/errata/RHSA-2026:61780
https://access.redhat.com/security/cve/CVE-2026-54099	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487950	Issue Tracking Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54099.json	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform::::::::
	cpe:2.3:a:redhat:windows_machine_config_operator:-:::::::*

History

No history.

Information

Published : 2026-06-22 14:17

Updated : 2026-09-09 13:20

NVD link : CVE-2026-54099

Mitre link : CVE-2026-54099

CVE.ORG link : CVE-2026-54099

JSON object : View

Products Affected

redhat

openshift_container_platform
windows_machine_config_operator

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-54099", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54099", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:windows_machine_config:10.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.21", "versions": [{"status": "unaffected", "version": "1787065708", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:windows_machine_config:10.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.22", "versions": [{"status": "unaffected", "version": "1783692800", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:windows_machine_config:10.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.21", "versions": [{"status": "unaffected", "version": "1787065708", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:windows_machine_config:10.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.22", "versions": [{"status": "unaffected", "version": "1783692800", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-22T14:17:40.820", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:47173", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:61780", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-54099", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487950", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:47173", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:61780", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-54099", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487950", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54099.json", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover."}], "lastModified": "2026-09-09T13:20:30.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A5FB226-0EC9-4963-9062-26C254D92F40", "versionEndExcluding": "4.22.1", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:a:redhat:windows_machine_config_operator:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2219154D-E4AD-4A8E-942A-C4804C00591C"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}