CVE-2026-54100

EUVD-2026-38234
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.3 HIGH
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 20.67%
Affected Products (NVD)
VendorProductVersion
redhatopenshift_container_platform
4.0 ≤
𝑥
≤ 4.22.1
redhatwindows_machine_config_operator
-
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat OpenShift for Windows Containers 10.22
1783692800 ≤
𝑥
< *
ADP
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/security/cve/CVE-2026-54100
https://bugzilla.redhat.com/show_bug.cgi?id=2487953
https://access.redhat.com/errata/RHSA-2026:47173
https://access.redhat.com/security/cve/CVE-2026-54100
https://bugzilla.redhat.com/show_bug.cgi?id=2487953
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54100.json