# CVE-2026-19706

OpenShift bootstrap service approves any CSR, enabling full cluster-admin compromise.

- Page: https://www.vulneraibility.com/cve/CVE-2026-19706
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-09)
- Weakness: CWE-306
- Published: 2026-11-09

## Affected

- Red Hat OpenShift Container Platform (agent-based installer, bootstrap node)
- approve-csr.service (bootstrap)
- Kubernetes CSR signing during install

## Impact

Attacker on install network can retrieve unauth Ignition, submit a CSR for CN=system:admin, get a signed cert and gain cluster-admin access during bootstrap.

## Action

Immediate action required

## Recommendation

Install Red Hat patch immediately; restrict install network and rotate cluster credentials.

## References

- [other] https://access.redhat.com/security/cve/CVE-2026-19706
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=2515215
- [other] https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/installing_an_on-premise_cluster_with_the_agent-based_installer/index
- [other] https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.