CVE-2026-54100: Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.
Other sources
Windows Machine Config Operator (WMCO) opens SSH sessions to Windows worker nodes without validating the remote server identity. Sensitive node configuration material is transferred over those sessions during normal reconciliation. If an attacker can position themselves on the network path between WMCO and the intended Windows node, they may be able to impersonate the node and obtain credentials WMCO delivers during configuration.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54100?
The severity of CVE-2026-54100 is high, with a CVSS score of 8.3.
How does CVE-2026-54100 enable credential theft?
CVE-2026-54100 allows an attacker to capture sensitive information by intercepting an SSH connection that does not verify the remote server host key.
What systems are affected by CVE-2026-54100?
The vulnerability affects the Windows Machine Config Operator used in Red Hat OpenShift Container Platform.
What is the risk level of CVE-2026-54100?
CVE-2026-54100 has a risk level of 72, indicating a significant threat to security.
How can I mitigate the risks associated with CVE-2026-54100?
To mitigate CVE-2026-54100, ensure that SSH sessions verify the remote server host key to prevent interception.