CVE-2026-19706 PUBLISHED

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

Assigner: redhat
Reserved: 13.08.2026 Published: 09.11.2026 Updated: 09.11.2026

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.3

Product Status

Vendor Red Hat
Product Assisted Installer for Red Hat OpenShift Container Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Assisted Installer for Red Hat OpenShift Container Platform 2
Versions Default: affected
Vendor Red Hat
Product Assisted Installer for Red Hat OpenShift Container Platform 2
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 5
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 5
Versions Default: unaffected

Credits

  • Red Hat would like to thank Chi Zhang (cz21) (External Researcher (August 8, 2026)) and Christopher Lusk (North Echo Security Research (August 26, 2026)) for reporting this issue.

References

Problem Types

  • Missing Authentication for Critical Functionality CWE