CVE-2026-54099 is a privilege escalation vulnerability in the Windows Machine Config Operator (WMCO) component of Red Hat OpenShift Container Platform. The WICD CSR auto-approver improperly validates the organization field in Certificate Signing Requests, allowing additional organization values such as system:masters to be accepted. A compromised Windows worker node with WICD credentials can submit a CSR that is auto-approved and signed by the cluster, granting cluster-administrator privileges and enabling full cluster takeover. This vulnerability affects OpenShift clusters running WMCO with Windows worker nodes. Exploitation requires local access to a Windows node and WICD credentials. Red Hat classifies this as an Important severity issue with a CVSS v3.1 base score of 8.8. No mitigation or workaround is currently available, and users are advised to apply updates when released in version 10.22.1 of Red Hat OpenShift for Windows Containers.

Successful exploitation grants an attacker cluster-administrator privileges from a compromised Windows worker node, enabling full control over the OpenShift cluster. This can lead to complete cluster takeover, affecting confidentiality, integrity, and availability at a high level. The vulnerability requires prior compromise of a Windows node and possession of WICD credentials, so the initial attack vector is local. Clusters without Windows nodes or without WMCO are not affected.

Currently, no mitigation or workaround is available for this vulnerability. Customers are advised to monitor Red Hat advisories and apply the update to Red Hat OpenShift for Windows Containers 10.22.1 once it becomes available. Follow the Windows Machine Config Operator upgrade documentation provided by Red Hat for applying the fix.