CVE ID :CVE-2026-19706
Published : Nov. 9, 2026, 5:20 p.m. | 1 hour, 8 minutes ago
Description :During ABI bootstrap, the bootstrap node’s approve-csr.service approves and signs every CSR without identity validation.
An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.
Exploitable only during the narrow bootstrap window.
Severity: 8.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More