Filtered by vendor Redhat Subscriptions
Filtered by product Windows Machine Config Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114406 1 Redhat 25 Acm, Advanced Cluster Security, Assisted Installer and 22 more 2026-10-22 6.8 Medium
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
CVE-2026-54100 1 Redhat 5 Openshift, Openshift Container Platform, Openshift For Windows Containers and 2 more 2026-10-14 8.3 High
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.
CVE-2026-54099 1 Redhat 5 Openshift, Openshift Container Platform, Openshift For Windows Containers and 2 more 2026-10-14 8.8 High
A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.
CVE-2025-8556 1 Redhat 23 Acm, Advanced Cluster Security, Ceph Storage and 20 more 2026-04-15 3.7 Low
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
CVE-2024-9042 1 Redhat 1 Windows Machine Config 2026-04-15 5.9 Medium
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
CVE-2024-45338 1 Redhat 27 Acm, Advanced Cluster Security, Ceph Storage and 24 more 2026-04-15 5.3 Medium
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CVE-2025-22869 2 Go, Redhat 17 Ssh, Acm, Advanced Cluster Security and 14 more 2025-05-01 7.5 High
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.