During ABI bootstrap, the `approve-csr.service` on the bootstrap node approves and signs every Certificate Signing Request (CSR) without performing identity validation. An attacker on the installation network can retrieve the unauthenticated Ignition file via ports 22623 or 22624, extract a limited kubeconfig, and submit a CSR for `CN=system:admin`. This allows the attacker to receive a signed certificate and obtain full cluster-admin access. This issue is only exploitable during the narrow bootstrap window.