CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.

• CWE-20

• https://access.redhat.com/security/cve/CVE-2026-101919
• https://bugzilla.redhat.com/show_bug.cgi?id=2542541

Published

Oct 5, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101913ip-address is a library for parsing and manipulating IPv4 an…6.3
• CVE-2026-101914@grpc/grpc-js implements the core functionality of gRPC pure…6.5
• CVE-2026-101915@grpc/grpc-js implements the core functionality of gRPC pure…3.7
• CVE-2026-101916@grpc/grpc-js implements the core functionality of gRPC pure…7.4
• CVE-2026-101917PyJWT is a Python implementation of JSON Web Token standards…7.5
• CVE-2026-101918PyJWT is a Python implementation of JSON Web Token standards…7.5
• CVE-2026-10192A vulnerability was identified in Tenda W12 3.0.0.7(4763). T…8.8
• CVE-2026-101920The Molongui Authorship – Author Boxes, Guest Authors & Co-A…7.2
• CVE-2026-101921The WPForms – AI Form Builder for WordPress – Contact Forms,…4.7
• CVE-2026-101923The Photo Reviews for WooCommerce plugin for WordPress is vu…8.1
• CVE-2026-101924The NewStatPress plugin for WordPress is vulnerable to Store…7.2
• CVE-2026-101925The bbp style pack plugin for WordPress is vulnerable to Sto…6.4