CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54100

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54100

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54099: Improper Privilege Management

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54100: Improper Certificate Validation

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

EUVD-2020-12581

Malware in sbrugna...

CVE-2020-1750

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operato...

CVE-2020-1750

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operato...

Code injection

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operato...

CVE-2020-1750

CVE-2020-1750 affects the OpenShift machine-config-operator. A memory stress scenario could render a node unresponsive and block scheduling of new pods. Affected releases were fixed in openshift/machine-config-operator versions 4.4.3, 4.3.25, and 4.2.36. Remediation is to upgrade to one of these ...

CVE-2020-1750

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operato...

PT-2021-10088

Name of the Vulnerable Software and Affected Versions: machine-config-operator versions prior to 4.2.36 machine-config-operator versions prior to 4.3.25 machine-config-operator versions prior to 4.4.3 Description: A flaw was found in the machine-config-operator that causes an OpenShift node to...

CVE-2020-1750: Uncontrolled Resource Consumption

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operato...

CVE-2020-35514

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShif...

PT-2021-11782

Name of the Vulnerable Software and Affected Versions: OpenShift versions prior to openshift4/ose-machine-config-operator v4.7.0-202105111858.p0. Description: An insecure modification flaw was found in the /etc/kubernetes/kubeconfig file in OpenShift, allowing an attacker with access to a running...

CVE-2020-35514: Incorrect Privilege Assignment

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShif...

Insecure Permissions

github.com/openshift/machine-config-operator uses insecure file permissions. The permissions of the file /etc/kubernetes/kubeconfig is overly permissive. An attacker with access to a running container that mounts /etc/kubernetes or has local access to the node will be able to copy the kubeconfig...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.3.25 security update

Red Hat OpenShift Container Platform release 4.3.25 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.4.3 ose-machine-config-operator-container security update

An update for ose-machine-config-operator-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...