CVE-2026-101919

Name of the Vulnerable Software and Affected Versions HyperShift operator (affected versions not specified)

Description A flaw in the HyperShift operator allows a tenant isolation bypass. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by providing a configuration that includes unauthorized executable plugins. When downstream controllers process this configuration, it can lead to arbitrary code execution within the control plane.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.