Skip to content
fr Sign in
8.3 High

CVE-2026-54100 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform

Description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift for Windows Containers 10.22 1783692800 earliest → < 1783692800 1783692800
Red Hat OpenShift for Windows Containers 10.21 1787065708 earliest → < 1787065708 1787065708
OpenShift Windows Machine Config Operator 10.21 1787065708 earliest → < 1787065708 1787065708
Red Hat OpenShift for Windows Containers 10.19 1789075615 earliest → < 1789075615 1789075615
Red Hat OpenShift for Windows Containers 10.20 1789075603 earliest → < 1789075603 1789075603

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Container Platform 4

The 629 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 7.1 High CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 6.5 Medium CVE-2026-120830 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 7.4 High CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High
Track this CVE