CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

High 8.3 Published 22 Jun 2026 Updated 14 Oct 2026

An attacker can intercept SSH connections to steal Windows node credentials due to missing host key verification in the Windows Machine Config Operator.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-54100?

CVE-2026-54100 is a high-severity vulnerability in Redhat Openshift Container Platform, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

Weakness: CWE-295

Which versions are affected by CVE-2026-54100?

It affects 2 products.

Products include Redhat Openshift Container Platform, Redhat Windows Machine Config Operator.

How do I fix CVE-2026-54100?

No fix has been published for CVE-2026-54100 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-54100 being exploited?

There is no known exploitation of CVE-2026-54100 in the wild and no public exploit code.

All Redhat Openshift Container Platform vulnerabilities

Sources

Also known as GHSA-q3jf-4x8j-368q.