Bug 2487950 (CVE-2026-54099)

Summary: CVE-2026-54099 windows-machine-config-operator: windows-machine-config-operator: WICD CSR extra-Organization allows privilege escalation to system:masters
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-11 17:04:17 UTC 
Windows Machine Config Operator's WICD CSR auto-approver validates CSRs for the kubernetes.io/kube-apiserver-client signer by only requiring the presence of system:wicd-nodes in the Subject Organization, while allowing additional groups such as system:masters. Since this signer does not restrict or filter extra O= values, all included organizations are copied into the issued certificate. If an attacker compromises a Windows node and obtains the WICD identity, they can submit a crafted CSR including both system:wicd-nodes and system:masters. The request is accepted by ValidateCSR() and approved by WMCO, resulting in a signed client certificate that grants system:masters (cluster-admin level) access.