CVE-2026-54100: Windows Machine Config Operator SSH Host Key Verification Bypass – OpenShift Security Flaw

Technical summary

CVE-2026-54100 stems from absent SSH host key verification in WMCO, a Red Hat component responsible for provisioning and managing Windows worker nodes in OpenShift clusters. The operator initiates SSH connections to Windows nodes without validating the remote server's public key, creating a Man-in-the-Middle (MITM) vulnerability. An adjacent-network attacker can redirect or intercept these connections, capturing WICD (Windows Instance Config Daemon) and kubelet bootstrap credentials transmitted during node initialization. This violates the principle of secure channel establishment and aligns with CWE-295 (Improper Certificate Validation). The vulnerability requires the attacker to be on the same network segment and able to intercept Layer 2 or Layer 3 traffic, explaining the CVSS vector's AC:H (High attack complexity).

Business impact

Compromise of Windows node credentials enables an attacker to authenticate as legitimate worker nodes, allowing injection of malicious workloads, exfiltration of cluster secrets, lateral movement to other nodes, and degradation of cluster availability. In multi-tenant or regulated environments, this can lead to compliance violations, data breach liability, and loss of trust in the cluster's integrity. The blast radius extends to any application scheduled on affected Windows nodes and potentially to shared cluster infrastructure if the attacker pivots using node privileges.

Affected systems

Red Hat OpenShift Container Platform deployments that use the Windows Machine Config Operator (WMCO) are affected. This includes on-premises, hybrid, and cloud-hosted OpenShift clusters running Windows worker nodes. Organizations using only Linux worker nodes are unaffected. The vulnerability exists in the WMCO component itself, so all versions lacking the security fix are at risk during node configuration and scaling operations.

Exploitability

Exploitation requires an attacker positioned on the same network segment as the WMCO control plane and Windows worker nodes (adjacent network). The attacker must be able to intercept or redirect SSH traffic, typically via ARP spoofing, DNS hijacking, or BGP hijacking depending on network topology. No user interaction is required, and exploitation can occur automatically when WMCO provisions or re-configures nodes. Once credentials are captured, the attacker gains persistent access to node identity without further interaction. The CVSS score of 8.3 reflects high confidentiality and integrity impact, though the adjacent-network requirement and attack complexity limit overall severity.

Remediation

Apply the security patch from Red Hat that implements SSH host key verification in WMCO. Organizations must update their OpenShift deployments and redeploy or reconfigure affected Windows worker nodes after the patch is applied, ensuring new SSH sessions use verified host keys. Additionally, isolate WMCO and Windows node networks from untrusted adjacent segments using network policies, firewalls, or network segmentation. Monitor for unexpected SSH connections to Windows nodes and rotate any credentials that may have been exposed prior to patching.

Patch guidance

Consult the Red Hat Security Advisory associated with CVE-2026-54100 for the specific WMCO version containing the fix. Apply the patch to your OpenShift cluster and verify via operator logs that WMCO is performing host key verification on subsequent node configurations. Test in a non-production cluster first to ensure compatibility. After patching, trigger a re-configuration or rolling restart of Windows worker nodes to establish new SSH sessions with verified keys. Document the patch application date and verify all nodes report healthy status post-update.

Detection guidance

Monitor SSH connection logs on Windows worker nodes for unexpected or failed connection attempts from the WMCO control plane. Look for patterns consistent with MITM attacks: repeated connection failures followed by successful connections from different source addresses, or SSH key mismatches in event logs. Monitor network traffic from WMCO for unencrypted credential transmission or anomalous SSH traffic redirection. Implement alerts on failed SSH host key verification attempts once the patch is deployed. Review WMCO audit logs for any credentials logged in plain text before the patch was applied.

Why prioritize this

Although the CVSS score is 8.3 (HIGH), this vulnerability should be treated as critical in environments using Windows worker nodes because: (1) it directly compromises cluster node identity and authentication, (2) the attack surface is broad—any network traffic between WMCO and Windows nodes is exposed, (3) the captured credentials enable persistent unauthorized access, and (4) detection is difficult without proactive network monitoring. Organizations should prioritize patching before the vulnerability is actively exploited, especially if WMCO is exposed to untrusted network segments.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects a HIGH severity vulnerability with a high impact on confidentiality, integrity, and availability (all 'H'), but tempered by the requirement for adjacency (AV:A) and high attack complexity (AC:H). The score appropriately captures the seriousness of credential theft and node compromise, but does not account for the operational criticality of Kubernetes cluster integrity. In practice, the business risk may exceed the numerical score because compromised node credentials represent a persistent backdoor into the cluster, not a temporary disruption.

Frequently asked questions