Aller au contenu
en Se connecter
8.3 Élevée

CVE-2026-54100 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform

Description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat OpenShift Container Platform 4 Versions non publiées
Red Hat OpenShift for Windows Containers Versions non publiées
Red Hat OpenShift for Windows Containers 10.22 1783692800 premières → < 1783692800 1783692800
Red Hat OpenShift for Windows Containers 10.21 1787065708 premières → < 1787065708 1787065708
OpenShift Windows Machine Config Operator 10.21 1787065708 premières → < 1787065708 1787065708
Red Hat OpenShift for Windows Containers 10.19 1789075615 premières → < 1789075615 1789075615
Red Hat OpenShift for Windows Containers 10.20 1789075603 premières → < 1789075603 1789075603

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat OpenShift Container Platform 4

Les 629 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 7.1 Élevée CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 6.5 Moyenne CVE-2026-120830 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 7.4 Élevée CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 Élevée
Suivre cette CVE