RHSA-2026:94562CriticalCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 11.0 product release

Published
November 3, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (5)

CVE-2026-53488 →CVE-2026-54099 →CVE-2026-76654 →CVE-2026-111943 →CVE-2026-114406 →

📋 Description

CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-54099 — windows-machine-config-operator: windows-machine-config-operator: WICD CSR extra-Organization allows privilege escalation to system:masters CVE-2026-76654 — kubelet: kubelet: Subpath symlinking on Windows nodes permits NTLM coercion CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products3

  • Red Hat OpenShift for Windows Containers 11.0
  • registry.redhat.io/openshift4-wincw/windows-machine-config-operator-bundle@sha256:d70546b19f98ca21ab08c06bcb8c65cc79dc09f2091cfe707b8517c6af6621e6_amd64 as a component of Red Hat OpenShift for Windows Containers 11.0
  • registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator@sha256:c0474170c4e8f0d8e9ff6270bc519abb1e9a9c0aab9227a50f20098aed402457_amd64 as a component of Red Hat OpenShift for Windows Containers 11.0

✅ Remediation

For Windows Machine Config Operator upgrades, see the following documentation: https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/windows_container_support_for_openshift/index#windows-node-upgrades Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path. Workaround: At this time, no mitigation or workaround is available for this vulnerability. Customers are advised to apply the appropriate updates as they become available. Workaround: Clusters with no Windows nodes need no change. These steps reduce exposure: - Limit who can create pods that schedule onto Windows nodes. - Prevent Windows nodes from opening SMB/UNC connections to untrusted networks. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (9)