{"id":"CVE-2026-101919","published":"2026-10-05T18:17:30.907","lastModified":"2026-10-07T21:17:07.153","description":"A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-101919","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542541","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an authenticated user to inject unauthorized executable plugins into the privileged control plane namespace, leading to arbitrary code execution.","exploitability":"Exploitation requires an authenticated user with cluster and secret creation permissions. The attacker must supply a configuration with unauthorized executable plugins.","blast_radius":"If exploited, this vulnerability could result in full control plane compromise, potentially leading to widespread damage within the Kubernetes cluster.","remediation":"Disable the HyperShift operator or restrict access to the feature until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","kubernetes","control-plane"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:07.048Z"}}