CVE-2026-54100

June 22, 2026, 6:33 p.m.

8.3
High

Description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

Product(s) Impacted

Vendor Product Versions
Redhat
  • Openshift Container Platform
  • Windows Machine Config Operator
  • *
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a redhat openshift_container_platform / / / / / / / /
a redhat windows_machine_config_operator / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2026-54100
https://bugzilla.redhat.com/show_bug.cgi?id=2487953

Tags

[email protected]
CWE-295
2026-06-22
CVE-2026-54100

CVSS Score

8.3 / 10

CVSS Data - 3.1

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: June 22, 2026, 2:17 p.m.
Last Modified: June 22, 2026, 6:33 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.