CVE-2026-19706

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.

An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.

Exploitable only during the narrow bootstrap window.