OpenShift approve-csr.service signs any CSR without validation
CVE-2026-19706 Published on November 9, 2026

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window.

NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 88 days later.

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Products Associated with CVE-2026-19706

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Assisted Installer
Red Hat Multicluster Engine
Red Hat Openshift

Affected Versions

Assisted Installer for Red Hat OpenShift Container Platform 2: Assisted Installer for Red Hat OpenShift Container Platform 2: Assisted Installer for Red Hat OpenShift Container Platform 2: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: