CVE-2026-54099Disclosure(redhat / openshift_container_platform)

LOWCVSS 8.8 · HIGH

Signal is active with 6 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

redhat CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openshift_container_platform
windows_machine_config_operator

Threat summary

6 mentions across 1 observed day

What's happening

Technical details provided in 5 signals
Disclosure: 6 classified signals
6 total mentions across 1 day

Affected systems

Vendors

redhat

Products

openshift_container_platformwindows_machine_config_operator

1 version affected across 2 products

Deep dive

Activity timeline6 mentions / 1d

Signal classification1 categories

Disclosure

6100.0%

Referenced assets6 URLs

By indicator

Full discourse6 posts

dbugs@ptdbugs92d
Disclosure
Windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters CVE: CVE-2026-54099 Vendor: Red hat Product: Red Hat OpenShift Container Platform 4 CVSS: 8.8 Credits: n/a Description: A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-54099 • https://access.redhat.com/security/cve/CVE-2026-54099 • https://bugzilla.redhat.com/show_bug.cgi?id=2487950 #dbugs_vuln
Post summary
The statement reports a privilege‑escalation flaw in Red Hat OpenShift’s Windows Machine Config Operator that lets a node obtain cluster‑admin certificates via auto‑approved CSRs (CVSS 8.8); no PoC, exploit, or patch is provided.
03053522
3.0K followersView on X
dbugs@ptdbugs92d
Disclosure
Windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters CVE: CVE-2026-54099 Vendor: Red hat Product: Red Hat OpenShift Container Platform 4 CVSS: 8.8 Credits: n/a Description: A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-54099 • https://access.redhat.com/security/cve/CVE-2026-54099 • https://bugzilla.redhat.com/show_bug.cgi?id=2487950 #dbugs_vuln
Post summary
The post announces CVE‑2026‑54099, explaining how WMCO automatically approves CSRs containing system:masters, enabling cluster‑administrator privileges; it provides technical details but no PoC, exploit, or active exploitation evidence.
00060527
3.0K followersView on X
dbugs@ptdbugs92d
Disclosure
Windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters CVE: CVE-2026-54099 Vendor: Red hat Product: Red Hat OpenShift Container Platform 4 CVSS: 8.8 Credits: n/a Description: A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-54099 • https://access.redhat.com/security/cve/CVE-2026-54099 • https://bugzilla.redhat.com/show_bug.cgi?id=2487950 #dbugs_vuln
Post summary
The post discloses a privilege‑elevation flaw in Red Hat OpenShift's Windows Machine Config Operator that allows a compromised worker node to generate an auto‑approved CSR, granting cluster‑admin rights. No PoC, exploit code, or active exploitation is mentioned.
00051624
3.0K followersView on X
VulDB 🛡@vuldb92d
Disclosure
A new vulnerability with increased severity was disclosed for Red Hat OpenShift Container Platform 4 and OpenShift for Windows Containers (CVE-2026-54099) https://vuldb.com/vuln/372682
Post summary
A new CVE-2026-54099 vulnerability with increased severity has been disclosed for Red Hat OpenShift platforms; no exploit details, patches, or in‑the‑wild activity are mentioned.
01010105
2.2K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-54099 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signi… https://www.cve.org/CVERecord?id=CVE-2026-54099 ----- Traducción: CVE-2026-54099 Se … http://infoflow.cloud`
Post summary
The post announces a new flaw in Red Hat OpenShift’s Windows Machine Config Operator that improperly validates certificate signatures, with no evidence of PoC, exploit code, or patch.
0000038
88 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-54099 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signi… https://www.cve.org/CVERecord?id=CVE-2026-54099
Post summary
A vulnerability in Red Hat OpenShift's Windows Machine Config Operator has been identified, affecting certificate signing validation via the WICD CSR auto‑approver.
00000725
57.7K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	redhat	openshift_container_platform	-	-	-
App	redhat	windows_machine_config_operator	-	-	-

Explore more

Back to dashboard redhat CVEs openshift_container_platform vulnerabilities

What researchers are saying

CVE-2026-54099

dbugs[verified]@ptdbugsDisclosure

The statement reports a privilege‑escalation flaw in Red Hat OpenShift’s Windows Machine Config Operator that lets a node obtain cluster‑admin certificates via auto‑approved CSRs (CVSS 8.8); no PoC, exploit, or patch is provided.

dbugs[verified]@ptdbugsDisclosure

The post announces CVE‑2026‑54099, explaining how WMCO automatically approves CSRs containing system:masters, enabling cluster‑administrator privileges; it provides technical details but no PoC, exploit, or active exploitation evidence.

dbugs[verified]@ptdbugsDisclosure

The post discloses a privilege‑elevation flaw in Red Hat OpenShift's Windows Machine Config Operator that allows a compromised worker node to generate an auto‑approved CSR, granting cluster‑admin rights. No PoC, exploit code, or active exploitation is mentioned.

VulDB 🛡@vuldbDisclosure

A new CVE-2026-54099 vulnerability with increased severity has been disclosed for Red Hat OpenShift platforms; no exploit details, patches, or in‑the‑wild activity are mentioned.

Infoflowcloud@infoflowcloudDisclosure

The post announces a new flaw in Red Hat OpenShift’s Windows Machine Config Operator that improperly validates certificate signatures, with no evidence of PoC, exploit code, or patch.

CVE@CVEnewDisclosure

A vulnerability in Red Hat OpenShift's Windows Machine Config Operator has been identified, affecting certificate signing validation via the WICD CSR auto‑approver.