CVE-2026-54100

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/errata/RHSA-2026:61780
https://access.redhat.com/security/cve/CVE-2026-54100	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487953	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/errata/RHSA-2026:61780
https://access.redhat.com/security/cve/CVE-2026-54100	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487953	Issue Tracking Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54100.json	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform::::::::
	cpe:2.3:a:redhat:windows_machine_config_operator:-:::::::*

History

No history.

Information

Published : 2026-06-22 14:17

Updated : 2026-09-09 13:20

NVD link : CVE-2026-54100

Mitre link : CVE-2026-54100

CVE.ORG link : CVE-2026-54100

JSON object : View

Products Affected

redhat

openshift_container_platform
windows_machine_config_operator

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-54100", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54100", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:windows_machine_config:10.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.21", "versions": [{"status": "unaffected", "version": "1787065708", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:windows_machine_config:10.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.22", "versions": [{"status": "unaffected", "version": "1783692800", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:windows_machine_config:10.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.21", "versions": [{"status": "unaffected", "version": "1787065708", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:windows_machine_config:10.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift for Windows Containers 10.22", "versions": [{"status": "unaffected", "version": "1783692800", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-22T14:17:40.950", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:47173", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:61780", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-54100", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487953", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:47173", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:61780", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-54100", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487953", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54100.json", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster."}], "lastModified": "2026-09-09T13:20:30.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F70390E-5DD6-42E4-AEA8-1C03337DDABC", "versionEndIncluding": "4.22.1", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:a:redhat:windows_machine_config_operator:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2219154D-E4AD-4A8E-942A-C4804C00591C"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}