windows machine config vulnerabilities (CVE)

6.8Medium

CVE-2026-114406 21 days ago

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

8.3High

CVE-2026-54100 4 months ago

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

Red Hat Red Hat OpenShift for Windows Containers 10.19; Red Hat Red Hat OpenShift for Windows Containers 10.20; Red Hat Red Hat OpenShift for Windows Containers 10.21; Red Hat Red Hat OpenShift for Windows Containers 10.22

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or r…

8.8High

CVE-2026-54099 4 months ago

Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

Red Hat Red Hat OpenShift for Windows Containers 10.19; Red Hat Red Hat OpenShift for Windows Containers 10.20; Red Hat Red Hat OpenShift for Windows Containers 10.21; Red Hat Red Hat OpenShift for Windows Containers 10.22

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organiz…