RHSA-2026:61780HighCVSS 8.8
Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 10.21.2 product release
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-54099 — windows-machine-config-operator: windows-machine-config-operator: WICD CSR extra-Organization allows privilege escalation to system:masters CVE-2026-54100 — windows-machine-config-operator: windows-machine-config-operator: SSH host key not verified enables credential theft
🎯 Affected products3
- Red Hat OpenShift for Windows Containers 10.21
- registry.redhat.io/openshift4-wincw/windows-machine-config-operator-bundle@sha256:e63940ce969148f938c5059c995669f0e93257e96b7e0925470ba10178cc6be1_amd64 as a component of Red Hat OpenShift for Windows Containers 10.21
- registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator@sha256:c5ffbe845d71ab95834ee74201fca1147954d6c3943042720831e06230228d8e_amd64 as a component of Red Hat OpenShift for Windows Containers 10.21
✅ Remediation
For Windows Machine Config Operator upgrades, see the following documentation: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/windows_container_support_for_openshift/windows-node-upgrades Workaround: At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:61780
- externalhttps://access.redhat.com/security/cve/CVE-2026-54099
- externalhttps://access.redhat.com/security/cve/CVE-2026-54100
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/windows_container_support_for_openshift/enabling-windows-container-workloads
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61780.json