During the Agent-Based Installation (ABI) bootstrap of OpenShift, the bootstrap node's approve-csr.service automatically approves and signs all Certificate Signing Requests (CSRs) without validating their identity. This allows an attacker with network access during the brief bootstrap window to retrieve an unauthenticated Ignition file, extract a limited kubeconfig, submit a CSR for the system:admin identity, and obtain a signed certificate granting full cluster-admin privileges.