CVE-2026-71567

HighCVSS 7.7

Published: 17/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In openshift-metal3/fakefish, some shell scripts inject variables without quoting them into command lines or manifests. This mostly applies to the Image URL and BMC credentials, which are not verified by FakeFish.

Risk Assessment

This may lead to unintended command execution or manifest manipulation, potentially resulting in unauthorized access or configuration changes.

Recommendation

It is recommended to properly quote variables in scripts and verify BMC credentials before use.

Other vulnerabilities in fakefish

CVE-2026-71566Critical
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

Original NVD description (English source)

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS