Every CVESearch/Get API key

CVE-2026-19706

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

8.3 High

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.13%Unchanged since Nov 10, 2026
90%50%10%1%

What each source reports

CVE List Score used8.3

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Record
CVE-2026-19706
CVSS 3.1
8.3 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-09
EUVDEUVD-2026-1201218.3

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Record
EUVD-2026-120121
CVSS 3.1
8.3 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-09
GitHub AdvisoriesGHSA-9686-4jg7-g9h38.3

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR...

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Record
GHSA-9686-4jg7-g9h3
CVSS 3.1
8.3 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-09
NVD8.3

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Record
CVE-2026-19706
CVSS 3.1
8.3 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-10

Affected products

History

History
RecordedChangedSources
publishedEUVD, NVD
products, published, references, severity, titleCVE List
publishedEUVD
aliases, cwes, references, severity, titleGitHub Advisories
first indexedEUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-19706 is a high vulnerability (CVSS 8.3) in Red Hat Assisted Installer For Red Hat Openshift Container Platform 2, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open