CVE-2026-54099

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

• CWE-269
• CWE-269

• https://access.redhat.com/errata/RHSA-2026:47173
• https://access.redhat.com/security/cve/CVE-2026-54099Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487950Issue Tracking, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:47173
• https://access.redhat.com/security/cve/CVE-2026-54099Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487950Issue Tracking, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54099.jsonVendor Advisory

Published

Jun 22, 2026

Last Modified

Jul 29, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54092File Browser is a file managing interface for uploading, del…6.5
• CVE-2026-54093File Browser is a file managing interface for uploading, del…6.8
• CVE-2026-54094File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-54095Rejected reason: CVE ** REJECT ** DO NOT USE THIS CANDIDATE …
• CVE-2026-54096File Browser is a file managing interface for uploading, del…8.4
• CVE-2026-54097File Browser is a file managing interface for uploading, del…7.2
• CVE-2026-54100A flaw was found in the Windows Machine Config Operator (WMC…8.3
• CVE-2026-54101Rejected reason: Reserved but no longer needed.
• CVE-2026-54102Rejected reason: Reserved but no longer needed.
• CVE-2026-54103The U.S. Government Accountability Office (GAO) Electronic P…9.8
• CVE-2026-54104The U.S. Government Accountability Office (GAO) Electronic P…8.8
• CVE-2026-54105The U.S. Government Accountability Office (GAO) Electronic P…6.9