{"id":"CVE-2026-19706","kind":"vulnerability","aliases":["CVE-2026-19706"],"related":[],"title":"OpenShift ABI bootstrap signs any certificate request, granting cluster-admin access","description":"During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.\n\nAn attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.\n\nExploitable only during the narrow bootstrap window.","summary":"During installation of an OpenShift cluster using the Agent-Based Installer, the bootstrap node's approve-csr service approves and signs every certificate signing request without checking who sent it. An attacker on the install network can fetch the unauthenticated Ignition file, extract a limited kubeconfig, request a certificate for system:admin, and receive a cluster-admin certificate.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","openshift","self-hosted"],"not_affected_if":["install-network-isolated","non-abi-install","post-bootstrap-clusters","trusted-install-network"],"how_to_check":"- Confirm whether a cluster is or was installed with the Agent-Based Installer on an install network reachable by others, using the `oc version` output from the cluster.\n- Check whether ports `22623` and `22624` are reachable from untrusted networks during bootstrap.","fix":null,"status":"open","published_at":"2026-11-09T18:17:27+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:13+00:00","updated_at":"2026-11-09T18:30:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T18:29:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenShift ABI bootstrap signs any certificate request, granting cluster-admin access","impact":"high","summary":"During installation of an OpenShift cluster using the Agent-Based Installer, the bootstrap node's approve-csr service approves and signs every certificate signing request without checking who sent it. An attacker on the install network can fetch the unauthenticated Ignition file, extract a limited kubeconfig, request a certificate for system:admin, and receive a cluster-admin certificate.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openshift","kubernetes","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains full cluster-admin access to the new OpenShift cluster.","analyst_note":"Sources list only NVD; confirm affected OpenShift versions, fixed release, and any vendor advisory for the Agent-Based Installer bootstrap flaw.","how_to_check":"- Confirm whether a cluster is or was installed with the Agent-Based Installer on an install network reachable by others, using the `oc version` output from the cluster.\n- Check whether ports `22623` and `22624` are reachable from untrusted networks during bootstrap.\n- unknown for a specific version check, as the sources do not list affected product versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["post-bootstrap-clusters","install-network-isolated"],"who_is_affected":"Only clusters being bootstrapped with the installer's bootstrap node during the install window are described as exposed. An attacker must be on the install network while bootstrap runs. Clusters not installed during this window are described as not exposed, though the sources do not explicitly say so.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000786,"input_tokens":4597,"output_tokens":653,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list only NVD; confirm affected OpenShift versions, fixed release, and any vendor advisory for the Agent-Based Installer bootstrap flaw.","search":"'-19706':15A,18A '-2026':14A,17A '22623/22624':115C 'abi':2A,87C 'access':12A,137C 'admin':11A,78B,84B,126C,136C 'agent':34B 'agent-bas':33B 'approv':42B,45B,94C 'approve-csr':41B 'approve-csr.service':93C 'attack':58B,103C 'base':35B 'bootstrap':3A,38B,88C,90C,143C 'certif':6A,49B,75B,85B,130C 'check':53B 'cluster':10A,30B,83B,135C 'cluster-admin':9A,82B,134C 'cn':124C 'csr':43B,98C,122C 'cve':13A,16A 'everi':48B,97C 'exploit':138C 'extract':69B,116C 'fetch':64B 'file':68B,113C 'full':133C 'gain':132C 'grant':8A 'host':24B 'ident':100C 'ignit':67B,112C 'infrastructur':19B 'instal':26B,36B,61B,106C 'kubeconfig':72B,119C 'kubernet':20B 'limit':71B,118C 'narrow':142C 'network':62B,107C 'node':39B,91C 'openshift':1A,21B,29B 'port':114C 'receiv':80B,127C 'request':7A,51B,73B 'retriev':109C 'self':23B 'self-host':22B 'sent':55B 'servic':44B 'sign':4A,47B,50B,96C,129C 'submit':120C 'system':77B,125C 'unauthent':66B,111C 'use':31B 'valid':101C 'window':144C 'without':52B,99C","nicknames":[],"mitigations":[],"who_affected":"Only clusters being bootstrapped with the installer's bootstrap node during the install window are described as exposed. An attacker must be on the install network while bootstrap runs. Clusters not installed during this window are described as not exposed, though the sources do not explicitly say so.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kubernetes","openshift","selfhosted"],"campaign_type":null,"search_a":"'-19706':15A,18A '-2026':14A,17A 'abi':2A 'access':12A 'admin':11A 'bootstrap':3A 'certif':6A 'cluster':10A 'cluster-admin':9A 'cve':13A,16A 'grant':8A 'openshift':1A 'request':7A 'sign':4A","search_b":"'admin':78B,84B 'agent':34B 'agent-bas':33B 'approv':42B,45B 'approve-csr':41B 'attack':58B 'base':35B 'bootstrap':38B 'certif':49B,75B,85B 'check':53B 'cluster':30B,83B 'cluster-admin':82B 'csr':43B 'everi':48B 'extract':69B 'fetch':64B 'file':68B 'host':24B 'ignit':67B 'infrastructur':19B 'instal':26B,36B,61B 'kubeconfig':72B 'kubernet':20B 'limit':71B 'network':62B 'node':39B 'openshift':21B,29B 'receiv':80B 'request':51B,73B 'self':23B 'self-host':22B 'sent':55B 'servic':44B 'sign':47B,50B 'system':77B 'unauthent':66B 'use':31B 'without':52B","search_c":"'22623/22624':115C 'abi':87C 'access':137C 'admin':126C,136C 'approv':94C 'approve-csr.service':93C 'attack':103C 'bootstrap':88C,90C,143C 'certif':130C 'cluster':135C 'cluster-admin':134C 'cn':124C 'csr':98C,122C 'everi':97C 'exploit':138C 'extract':116C 'file':113C 'full':133C 'gain':132C 'ident':100C 'ignit':112C 'instal':106C 'kubeconfig':119C 'limit':118C 'narrow':142C 'network':107C 'node':91C 'port':114C 'receiv':127C 'retriev':109C 'sign':96C,129C 'submit':120C 'system':125C 'unauthent':111C 'valid':101C 'window':144C 'without':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19706","severity":null,"published_at":"2026-11-09T18:17:27+00:00","modified_at":"2026-11-09T18:17:27+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19706:2313","url":"https://access.redhat.com/security/cve/CVE-2026-19706","severity":null,"published_at":"2026-11-09T18:30:21+00:00","modified_at":"2026-11-09T18:30:21+00:00","first_seen_at":"2026-11-09T18:30:21+00:00","fetched_at":"2026-11-09T18:30:21+00:00","note":"Red Hat CVE page read: confirms approve-csr.service unconditionally approves CSRs during ABI bootstrap, needs network adjacency to API server; lists no affected versions, fixed release, errata or mitigation. NVD page fetch returned only homepage. web-cli search unavailable (not in toolset), X not tried. Fix/versions unknown; check the Red Hat CVE page for errata.","cites":["https://access.redhat.com/security/cve/CVE-2026-19706","https://nvd.nist.gov/vuln/detail/CVE-2026-19706"]}],"documents":[{"id":108906,"url":"https://access.redhat.com/security/cve/CVE-2026-19706","title":"Red Hat CVE-2026-19706","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":108907,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19706","title":"NVD CVE-2026-19706","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}