RHSA-2026:47173HighCVSS 8.8
Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 10.22.1 product release
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-54099 — windows-machine-config-operator: windows-machine-config-operator: WICD CSR extra-Organization allows privilege escalation to system:masters CVE-2026-54100 — windows-machine-config-operator: windows-machine-config-operator: SSH host key not verified enables credential theft
🎯 Affected products3
- Red Hat OpenShift for Windows Containers 10.22
- registry.redhat.io/openshift4-wincw/windows-machine-config-operator-bundle@sha256:6c20b766b0c63111d59d3c0b46b248e03f41a8fe2559f5c7a108cb1738f22b71_amd64 as a component of Red Hat OpenShift for Windows Containers 10.22
- registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator@sha256:3aacd9560f3408becf4b3618590a620d72aff0313a5efb23542552a6fd59500f_amd64 as a component of Red Hat OpenShift for Windows Containers 10.22
✅ Remediation
For Windows Machine Config Operator upgrades, see the following documentation: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/windows_container_support_for_openshift/windows-node-upgrades Workaround: At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:47173
- externalhttps://access.redhat.com/security/cve/CVE-2026-54099
- externalhttps://access.redhat.com/security/cve/CVE-2026-54100
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/windows_container_support_for_openshift/enabling-windows-container-workloads
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47173.json