Bug 2542541 (CVE-2026-101919)

Summary: CVE-2026-101919 hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: asegurap, gparvin, jbalunas, jburrell, rhaigner, tsze
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-28 15:53:08 UTC 
A flaw was found in the HyperShift operator. In the ReconcileCredentials function, the operator copies a user-provided kubeconfig Secret (referenced via HostedCluster spec.platform.kubevirt.credentials.infraKubeConfigSecret) verbatim into the control plane namespace without any validation or sanitization:

  for k, v := range sourceSecret.Data {
      targetSecret.Data[k] = v
  }

No exec-provider stripping, no AuthProvider validation, no InsecureSkipTLSVerify guard, and no BearerTokenFile check is performed. This allows a tenant with HostedCluster and Secret creation permissions in their namespace to inject arbitrary kubeconfig content - including exec credential plugins - into the control plane namespace where it is consumed by downstream controllers (such as CAPK).

This is a defense-in-depth failure independent of the CAPK exec-provider RCE. Even after CAPK is patched to strip exec providers, the HyperShift operator should validate kubeconfig content before copying it into the privileged control plane namespace.

Identified during Red Hat ProdSec analysis of the CAPK exec-provider report (PSIRTSUPT-24794).

Source repo: https://github.com/openshift/hypershift