CVE-2026-54100 is a vulnerability in the Windows Machine Config Operator (WMCO) component of Red Hat OpenShift Container Platform. WMCO fails to verify the SSH server host key when connecting to Windows worker nodes, violating proper SSH security practices (CWE-295). This allows an attacker on the adjacent network capable of intercepting or redirecting the SSH session to capture WICD and kubelet bootstrap credentials transferred during node configuration. Such credential compromise can lead to the attacker impersonating Windows nodes within the OpenShift cluster, impacting confidentiality, integrity, and availability of the cluster nodes. The vulnerability has a CVSS 3.1 vector of AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating high impact but requiring adjacent network access and high attack complexity.

An adjacent-network attacker able to intercept or redirect WMCO's SSH connections can capture sensitive bootstrap credentials used for Windows node identity in the cluster. This credential exposure can lead to compromise of Windows nodes, affecting cluster security and potentially allowing unauthorized actions within the cluster environment. The vulnerability impacts confidentiality, integrity, and availability of affected nodes.

Red Hat has released updated components for Red Hat OpenShift for Windows Containers 10.22.1 that address this vulnerability. Users should upgrade the Windows Machine Config Operator as per Red Hat's official guidance documented at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/windows_container_support_for_openshift/windows-node-upgrades. Applying these updates mitigates the vulnerability by correcting the SSH host key verification process. No additional mitigations are indicated by the vendor advisory.