← CVE Intelligence

CVE-2026-54099

Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters PUBLISHED

Description (CNA)

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift for Windows Containers 10.19unaffected 1789075615 before *
Red Hat / Red Hat OpenShift for Windows Containers 10.20unaffected 1789075603 before *
Red Hat / Red Hat OpenShift for Windows Containers 10.21unaffected 1787065708 before *
Red Hat / Red Hat OpenShift for Windows Containers 10.22unaffected 1783692800 before *
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat OpenShift Container Platform 4affected

CWE

CWE-269

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.