Executive brief
A security flaw in the Red Hat OpenShift Windows Machine Config Operator (WMCO) allows an attacker who has already compromised a Windows worker node to escalate their privileges to full cluster administrator. The WMCO component, which manages Windows nodes within an OpenShift cluster, fails to properly verify certificate requests, allowing a restricted user to claim unauthorized administrative rights. This could lead to a total takeover of the entire container platform and all data hosted within it.
Technical details
A flaw exists in the Windows Instance Config Daemon (WICD) CSR auto-approver within the Windows Machine Config Operator (WMCO). The `ValidateCSR()` function verifies that a Certificate Signing Request (CSR) contains the 'system:wicd-nodes' organization but fails to reject or strip additional organization values. An attacker with local access to a Windows worker node and WICD credentials can submit a crafted CSR containing both 'system:wicd-nodes' and 'system:masters'. Because the 'kubernetes.io/kube-apiserver-client' signer does not filter these values, the resulting signed certificate grants the attacker 'system:masters' (cluster-admin) privileges, leading to a full cluster takeover.
Affected products
- Red Hat OpenShift Container Platform 4 4
- Red Hat OpenShift for Windows Containers All
- Red Hat Windows Machine Config Operator (WMCO) All versions prior to fix
Timeline
- 2026-06-11: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-22: advisory: CVE published by Red Hat and NVD