CVE-2026-101919: HyperShift Operator RCE Vulnerability

CVE-2026-101919 Overview

CVE-2026-101919 is an input validation flaw [CWE-20] in the HyperShift operator, a Kubernetes control plane management component maintained by Red Hat. The operator copies user-supplied kubeconfig secrets directly into the privileged control plane namespace without validation or sanitization. An authenticated user holding cluster and secret creation permissions can embed unauthorized executable plugin references in a kubeconfig. When downstream controllers consume the configuration, the referenced plugin executes, resulting in arbitrary code execution inside the control plane. The vulnerability is network-exploitable and requires only low privileges, giving attackers a path to tenant isolation break and lateral movement across hosted clusters.

Critical Impact

An authenticated low-privilege tenant can achieve arbitrary code execution inside the HyperShift control plane namespace, breaking tenant isolation.

Affected Products

• Red Hat HyperShift operator
• Red Hat OpenShift hosted control planes based on HyperShift
• Downstream Kubernetes distributions that bundle the HyperShift operator

Discovery Timeline

• 2026-10-05 - CVE-2026-101919 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-101919

Vulnerability Analysis

The HyperShift operator provisions hosted Kubernetes control planes for multi-tenant environments. Tenants submit a kubeconfig secret that the operator uses to communicate with downstream resources. The operator copies this secret, as-is, into a privileged namespace where management controllers consume it.

Kubernetes kubeconfig files support an exec credential plugin stanza. This stanza instructs any client-go based consumer to execute an external binary to obtain credentials. When a downstream controller loads the attacker-controlled kubeconfig, it executes the referenced binary inside the control plane pod with the service account privileges of that controller.

The flaw is categorized as improper input validation [CWE-20]. The operator trusts tenant-provided configuration content without stripping or rejecting dangerous fields.

Root Cause

The operator lacks a schema allowlist for incoming kubeconfig secrets. It does not reject or sanitize users[].user.exec entries, users[].user.tokenFile entries, or other fields that cause the consuming client to perform filesystem or process operations. Secrets cross the tenant-to-control-plane trust boundary without transformation.

Attack Vector

An authenticated user with permission to create a HostedCluster or NodePool and the associated secret crafts a kubeconfig containing an exec plugin that points to an attacker-controlled command. The user submits the resource through the Kubernetes API. The HyperShift operator replicates the secret into the control plane namespace. When a downstream controller reconciles the resource and loads the kubeconfig through client-go, it invokes the plugin, executing arbitrary commands with the controller's service account token mounted in the pod.

No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA KEV catalog. The current EPSS probability is 0.422%.

Detection Methods for CVE-2026-101919

Indicators of Compromise

• Secret objects in HyperShift control plane namespaces whose kubeconfig data contains a users[].user.exec block referencing non-standard binaries.
• Unexpected child processes spawned by HyperShift controller pods, particularly shells or interpreters invoked from client-go credential plugin paths.
• Outbound network connections from control plane pods to IP addresses or domains not associated with managed cluster endpoints.

Detection Strategies

• Audit Secret create and update events in tenant namespaces and compare the referenced kubeconfig contents against a schema that forbids exec, tokenFile, and auth-provider fields.
• Run runtime process monitoring on HyperShift operator and control plane pods to flag any execution of binaries outside the controller image's expected process tree.
• Correlate Kubernetes audit logs with container runtime telemetry to detect secret writes immediately followed by anomalous process execution inside the target namespace.

Monitoring Recommendations

• Forward Kubernetes audit logs and container runtime events to a centralized analytics platform for continuous correlation.
• Alert on service account token use from control plane pods against the management cluster API server when the calling process is not the controller binary.
• Track changes to HostedCluster and NodePool resources that reference newly created kubeconfig secrets from low-privilege tenants.

How to Mitigate CVE-2026-101919

Immediate Actions Required

• Apply the fixed HyperShift operator build published in the Red Hat advisory as soon as it is available in your release channel.
• Restrict create and update permissions on Secret and HostedCluster resources to vetted service accounts only.
• Inventory existing tenant-supplied kubeconfig secrets and delete any that contain exec, tokenFile, or auth-provider stanzas.

Patch Information

Red Hat tracks remediation in Bugzilla entry 2542541. Refer to the Red Hat CVE-2026-101919 Advisory and the Red Hat Bug 2542541 Details for fixed package versions and update procedures specific to your OpenShift release channel.

Workarounds

• Deploy a Kubernetes admission controller, such as Kyverno or OPA Gatekeeper, that rejects any Secret whose decoded kubeconfig contains exec, tokenFile, or auth-provider fields.
• Enforce namespace-scoped RBAC that prevents low-privilege tenants from writing arbitrary secret payloads into namespaces consumed by HyperShift controllers.
• Run HyperShift controller pods with a read-only root filesystem and a restrictive seccomp profile to limit the impact of unexpected process execution.

# Kyverno ClusterPolicy fragment to block dangerous kubeconfig stanzas
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-exec-kubeconfig
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-exec-plugin
      match:
        any:
          - resources:
              kinds:
                - Secret
      validate:
        message: "kubeconfig secrets must not contain exec, tokenFile, or auth-provider stanzas"
        deny:
          conditions:
            any:
              - key: "{{ request.object.data.kubeconfig | base64_decode(@) }}"
                operator: AnyIn
                value:
                  - "*exec:*"
                  - "*tokenFile:*"
                  - "*auth-provider:*"