CVE-2026-54099: Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.
Other sources
Windows Machine Config Operator's WICD CSR auto-approver validates CSRs for the kubernetes.io/kube-apiserver-client signer by only requiring the presence of system:wicd-nodes in the Subject Organization, while allowing additional groups such as system:masters. Since this signer does not restrict or filter extra O= values, all included organizations are copied into the issued certificate. If an attacker compromises a Windows node and obtains the WICD identity, they can submit a crafted CSR including both system:wicd-nodes and system:masters. The request is accepted by ValidateCSR() and approved by WMCO, resulting in a signed client certificate that grants system:masters (cluster-admin level) access.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54099?
The severity of CVE-2026-54099 is rated as high with a score of 8.8.
How do I fix CVE-2026-54099?
To mitigate CVE-2026-54099, ensure that the Windows Machine Config Operator is updated to the latest version provided by Red Hat.
What impact does CVE-2026-54099 have?
CVE-2026-54099 allows a privilege escalation to system:masters, which could lead to unauthorized access and control over the system.
Who is affected by CVE-2026-54099?
CVE-2026-54099 affects users of the Red Hat Windows Machine Config Operator in OpenShift Container Platform.
What causes CVE-2026-54099?
CVE-2026-54099 is caused by inadequate validation of the organization values in a Certificate Signing Request by the WICD CSR auto-approver.