CVE-2026-19706

Summary

During cluster bootstrap, the approve-csr.service signs all Certificate Signing Requests without validating the requester's identity, allowing an attacker on the install network to obtain a cluster-admin certificate by submitting a CSR for CN=system:admin.

Exploitability

Exploitation is only possible during the narrow bootstrap window when the bootstrap node is active and the approve-csr.service is running in its vulnerable state; the attacker must be on the same install network to access the Ignition endpoint and submit CSRs.

Blast radius

Successful exploitation grants full cluster-admin access, enabling complete compromise of the Kubernetes cluster including data exfiltration, lateral movement, and destruction of workloads.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenShift Container Platform 4.16.0 or later, where the bootstrap CSR approval logic has been fixed to require identity validation before signing CSRs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.