Windows Machine Config Operator's WICD CSR auto-approver validates CSRs for the kubernetes.io/kube-apiserver-client signer by only requiring the presence of system:wicd-nodes in the Subject Organization, while allowing additional groups such as system:masters. Since this signer does not restrict or filter extra O= values, all included organizations are copied into the issued certificate. If an attacker compromises a Windows node and obtains the WICD identity, they can submit a crafted CSR including both system:wicd-nodes and system:masters. The request is accepted by ValidateCSR() and approved by WMCO, resulting in a signed client certificate that grants system:masters (cluster-admin level) access.