The vulnerability CVE-2026-54100 affects the Windows Machine Config Operator (WMCO) in Red Hat OpenShift for Windows Containers 10.22. WMCO fails to verify the SSH server host key when connecting to Windows worker nodes. This flaw enables an attacker with adjacent network access to intercept or redirect SSH sessions and capture WICD and kubelet bootstrap credentials used during node configuration. These credentials could allow the attacker to compromise Windows node identities in the OpenShift cluster. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory references a product release 10.22.1 that addresses related issues but does not explicitly confirm a patch for this vulnerability. No known exploits are reported in the wild as of the advisory date.

An attacker with adjacent network access can intercept or redirect SSH connections from WMCO to Windows worker nodes due to lack of host key verification. This allows capture of sensitive bootstrap credentials (WICD and kubelet), enabling compromise of Windows node identities within the cluster. The vulnerability impacts confidentiality, integrity, and availability of the affected nodes and potentially the cluster.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-54100 for current remediation guidance. The advisory mentions a product release 10.22.1 with updates to WMCO but does not explicitly confirm a fix for this vulnerability. Until an official fix is confirmed and applied, restrict adjacent network access to WMCO SSH connections to prevent interception or redirection. Follow Red Hat documentation for Windows node upgrades: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/windows_container_support_for_openshift/windows-node-upgrades.