CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4

High 8.8 Published 22 Jun 2026 Updated 14 Oct 2026

A compromised Windows node can obtain cluster-admin privileges by submitting a Certificate Signing Request with extra organization fields, enabling full cluster takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-54099?

CVE-2026-54099 is a high-severity vulnerability in Redhat Openshift Container Platform, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

Weakness: CWE-269

Which versions are affected by CVE-2026-54099?

It affects 2 products.

Products include Redhat Openshift Container Platform, Redhat Windows Machine Config Operator.

How do I fix CVE-2026-54099?

No fix has been published for CVE-2026-54099 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-54099 being exploited?

There is no known exploitation of CVE-2026-54099 in the wild and no public exploit code.

All Redhat Openshift Container Platform vulnerabilities

Sources

Also known as GHSA-x82v-328r-gf3h.