{"id":"CVE-2026-54099","aliases":["EUVD-2026-38233","GHSA-x82v-328r-gf3h"],"status":"published","title":"Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters","description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00131,"percentile":0.02726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-06-22T12:46:04Z","modified":"2026-11-04T05:28:17Z","products":[{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift for windows containers 10.19"},{"vendor":"red hat","product":"red hat openshift for windows containers 10.20"},{"vendor":"red hat","product":"red hat openshift for windows containers 10.21"},{"vendor":"red hat","product":"red hat openshift for windows containers 10.22"},{"vendor":"red hat","product":"red hat openshift for windows containers 11.0"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"windows_machine_config_operator"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:47173","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61780","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:81397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94562","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54099","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487950","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54099.json","tags":["x_sadp-csaf-vex","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54099"},{"url":"https://github.com/advisories/GHSA-x82v-328r-gf3h"}],"sources":{"cve":[{"id":"CVE-2026-54099","title":"Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters","description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","status":"published","published":"2026-06-22T12:46:04.051Z","modified":"2026-11-04T05:28:17.915Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269","CWE-269"],"updated_at":"2026-11-04T06:53:01.479776Z"}],"euvd":[{"id":"EUVD-2026-38233","description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","status":"published","published":"2026-06-22T12:46:04Z","modified":"2026-11-04T05:28:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T07:00:56.104537Z"}],"ghsa":[{"id":"GHSA-x82v-328r-gf3h","title":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container...","description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-11-04T06:33:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-04T06:56:58.885599Z"}],"nvd":[{"id":"CVE-2026-54099","description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","status":"published","published":"2026-06-22T14:17:40.82Z","modified":"2026-11-04T06:17:05.153Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-04T11:59:33.727659Z"}]}}