CVE-2026-54100

HIGH

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

Title source: cna

Description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

References (3)

Core 3

Core References

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54100.json

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-54100

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2487953

https://bugzilla.redhat.com/show_bug.cgi?id=2487953

Scores

CVSS v3 8.3

EPSS 0.0018

EPSS Percentile 7.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-295

Status published

Products (4)

Red Hat/Red Hat OpenShift Container Platform 4

Red Hat/Red Hat OpenShift for Windows Containers

redhat/openshift_container_platform 4.0 - 4.22.1

redhat/windows_machine_config_operator

Published Jun 22, 2026

Tracked Since Jun 22, 2026