CVE Feed

    Dashboard / CVE / CVE-2026-19706

    CVE-2026-19706

    During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window.

    Published:Nov 9, 2026
    Last Modified:Nov 9, 2026
    EPS:Nov 9, 2026
    EPSS Score:
    CVSS Score:8.3

    Affected Products

    Vendor
    Redhat
    Product
    Assisted Installer
    Vendor
    Redhat
    Product
    Multicluster Engine
    Vendor
    Redhat
    Product
    Openshift

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-101295 (CVSS 7.3) — Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operato…
    CVE-2026-96577 (CVSS 7.1) — A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all net…
    CVE-2024-3727 (CVSS 8.3) — A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected …
    CVE-2023-39325 (CVSS 7.5) — A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive serve…
    CVE-2023-44487 (CVSS 7.5) — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can …
    CVE-2021-3684 (CVSS 5.5) — A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull …

    References

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High