Is CVE-2026-54100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54100 being exploited in the wild.

How severe is CVE-2026-54100?

High severity, with a CVSS score of 8.3, published 22 June 2026.

Which products and versions are affected?

Red Hat OpenShift for Windows Containers 4.

Is there a fix for CVE-2026-54100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54100 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-54100?

Check whether you run Red Hat OpenShift for Windows Containers or Red Hat Windows Machine Config Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54100: Red Hat WMCO improper SSH host key verification in OpenShift

CVE-2026-54100 · Severity: high · CVSS 8.3 · Published 2026-06-22

The Windows Machine Config Operator (WMCO) is a component of Red Hat OpenShift used to manage and configure Windows-based worker nodes within a cluster. A security flaw allows an attacker on the same local network to intercept the setup process because the system fails to verify the identity of the Windows nodes it connects to. This could allow an attacker to steal administrative credentials, potentially leading to a full takeover of the Windows nodes and compromising the security of the entire container platform.

Vendors: Red Hat.

Quick answers

Is CVE-2026-54100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54100 being exploited in the wild.
How severe is CVE-2026-54100?: High severity, with a CVSS score of 8.3, published 22 June 2026.
Which products and versions are affected?: Red Hat OpenShift for Windows Containers 4.
Is there a fix for CVE-2026-54100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54100 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-54100?: Check whether you run Red Hat OpenShift for Windows Containers or Red Hat Windows Machine Config Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in the Windows Machine Config Operator (WMCO) due to improper validation of SSH host keys (CWE-295) during the node reconciliation process. When WMCO establishes SSH connections to Windows worker nodes to perform configuration tasks, it does not verify the remote server's identity. An attacker positioned on an adjacent network can perform a man-in-the-middle (MitM) attack to intercept or redirect these SSH sessions. By impersonating a legitimate node, the attacker can capture WICD and kubelet bootstrap credentials transferred during configuration, leading to the compromise of Windows node identities within the OpenShift cluster. This vulnerability requires the attacker to be on the same network segment as the WMCO or the target nodes.

Affected products

Red Hat OpenShift Container Platform 4 4
Red Hat OpenShift for Windows Containers 4
Red Hat Windows Machine Config Operator (WMCO)

Timeline

2026-06-11: disclosed: Initial report in Red Hat Bugzilla
2026-06-22: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.