A flaw was found in the HyperShift operator. (CVE-2026-101919)

CVE-2026-101919 describes a security flaw in the HyperShift operator where it improperly handles user-supplied Kubernetes configuration (kubeconfig) secrets by copying them directly into the privileged control plane namespace without validation or sanitization. An attacker with cluster and secret creation permissions can supply a malicious configuration containing unauthorized executable plugins. When these configurations are consumed by downstream controllers, it results in arbitrary code execution within the control plane environment.

Successful exploitation allows an authenticated user with specific permissions to execute arbitrary code in the privileged control plane, potentially leading to full compromise of the cluster control plane, affecting confidentiality, integrity, and availability of the Kubernetes environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict cluster and secret creation permissions to trusted users only and monitor for suspicious configurations. Avoid deploying untrusted kubeconfig secrets in the control plane namespace.