Insufficient Identity Validation in OpenShift's Bootstrap Node
CVE-2026-19706

8.3HIGH

Key Information:

Vendor

Red Hat
Status
Assisted Installer For Red Hat Openshift Container Platform 2
Multicluster Engine For Kubernetes
Red Hat Openshift Container Platform 4
Red Hat Openshift Container Platform 5
Vendor
CVE Published:
9 November 2026

What is CVE-2026-19706?

A security flaw exists during the ABI bootstrap process in OpenShift's bootstrap node, where the approve-csr.service is designed to approve and sign certificate signing requests (CSRs) without performing necessary identity validations. This vulnerability allows an attacker who has access to the installation network to retrieve the unauthenticated Ignition file through specific ports, extract a restricted kubeconfig, and submit a CSR impersonating the system administrator. Once the CSR is approved, the attacker can obtain a signed certificate, granting them full cluster-admin privileges. This exploit is limited to a brief bootstrap window, making timely action critical for administrators.

References

https://access.redhat.com/security/cve/CVE-2026-19706
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2515215
issue-trackingx_refsource_REDHAT
https://docs.redhat.com/en/documentation/openshift_contai...

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Chi Zhang (cz21) (External Researcher (August 8, 2026)) and Christopher Lusk (North Echo Security Research (August 26, 2026)) for reporting this issue.
.