RHSA-2026:81397HighCVSS 8.8
Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 10.19.3 product release
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-54099 — windows-machine-config-operator: windows-machine-config-operator: WICD CSR extra-Organization allows privilege escalation to system:masters CVE-2026-54100 — windows-machine-config-operator: windows-machine-config-operator: SSH host key not verified enables credential theft
🎯 Affected products3
- Red Hat OpenShift for Windows Containers 10.19
- registry.redhat.io/openshift4-wincw/windows-machine-config-operator-bundle@sha256:b6559585a2562d6ad8fef99b0b7a599f5e88e8ca58cd0be3a16ba009770e7c64_amd64 as a component of Red Hat OpenShift for Windows Containers 10.19
- registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator@sha256:3b88fad22c2b1d75148e706120752da93c4538a301dc5a14be457db44a38e067_amd64 as a component of Red Hat OpenShift for Windows Containers 10.19
✅ Remediation
For Windows Machine Config Operator upgrades, see the following documentation: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/windows_container_support_for_openshift/index#windows-node-upgrades Workaround: At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:81397
- externalhttps://access.redhat.com/security/cve/CVE-2026-54099
- externalhttps://access.redhat.com/security/cve/CVE-2026-54100
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/windows_container_support_for_openshift/index
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81397.json