Executive Summary

The vulnerability in CVE-2026-54100 affects the Windows Machine Config Operator (WMCO) used in Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes but does not verify the remote server's host key. This means that an attacker on the adjacent network can intercept or redirect these SSH sessions.

By exploiting this flaw, the attacker can capture sensitive credentials, specifically WICD and kubelet bootstrap credentials, which are transferred during the node configuration process. This enables the attacker to compromise the identities of Windows nodes within the cluster.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts by allowing an attacker on the same network to intercept SSH sessions between WMCO and Windows worker nodes. The attacker can steal critical credentials used for node configuration.

With these stolen credentials, the attacker can impersonate Windows nodes in the cluster, potentially gaining unauthorized access and control over those nodes. This can lead to compromise of the cluster's integrity, confidentiality, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability arises because WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key, allowing interception and credential theft.

To mitigate this vulnerability immediately, ensure that SSH connections from WMCO verify the remote server's host key to prevent man-in-the-middle attacks.

Since the issue is under review by Red Hat Product Security, monitor official Red Hat advisories for patches or updates that address this flaw and apply them as soon as they become available.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an adjacent-network attacker to intercept or redirect SSH sessions and capture sensitive credentials used during node configuration. This exposure of sensitive information could lead to unauthorized access and compromise of Windows node identities within the cluster.

Such unauthorized access and potential data compromise may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure authentication mechanisms to prevent unauthorized disclosure and access.

Useful 0 Not Useful 0