{"affected":[{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.19","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789075615","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.20","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789075603","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.21","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787065708","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.22","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783692800","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 11.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793279001","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4-wincw/windows-machine-config-rhel8-operator","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.21","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787065708","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 10.22","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783692800","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4-wincw/windows-machine-config-rhel8-operator","product":"Red Hat OpenShift Container Platform 4","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift Container Platform 4","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-54099","cwes":["CWE-269"],"description":"A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.","epss":{"date":"2026-11-03","percentile":0.01625,"score":0.00116},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793770097915,"publishedAt":1782132364051,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:47173"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:61780"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:81397"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:82440"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:94562"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-54099"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487950"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-54099"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487950"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54099.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:61780"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:47173"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available."},{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:61780: Red Hat OpenShift for Windows Containers 10.21\n\nRHSA-2026:47173: Red Hat OpenShift for Windows Containers 10.22"},{"kind":"workaround","source":"ADP: redhat-SADP","text":"At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available."}],"revision":"d5f3657bdbd89aee76b244b69c61d0cd21cc2dcac0121fc5f5703b9555061fbd","sources":[{"modifiedAt":1793770097915,"name":"CNA: redhat","retrievedAt":1793772734321,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54099"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793772743344,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54099"}],"ssvc":{"assessedAt":1782086400000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters","updatedAt":1793772743344}