CVE-2026-101919

Summary

The flaw allows an authenticated user to inject unauthorized executable plugins into the privileged control plane namespace, leading to arbitrary code execution.

Exploitability

Exploitation requires an authenticated user with cluster and secret creation permissions. The attacker must supply a configuration with unauthorized executable plugins.

Blast radius

If exploited, this vulnerability could result in full control plane compromise, potentially leading to widespread damage within the Kubernetes cluster.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the HyperShift operator or restrict access to the feature until a patch is available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.