CVE-2026-54100

Severity CVSS v4.0:

Pending analysis

Type:

CWE-295 Improper Certificate Validation

Publication date:

22/06/2026

Last modified:

29/07/2026

Description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO&#39;s SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.30 HIGH
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.30

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:redhat:openshift_container_platform::::::::	4.0 (including)	4.22.1 (including)
cpe:2.3:a:redhat:windows_machine_config_operator:-:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-54100

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools