CVE Catalog
CVE-2026-71567
HighCVSS 7.7Summary
In openshift-metal3/fakefish, some shell scripts inject variables without quoting them into command lines or manifests. This mostly applies to the Image URL and BMC credentials, which are not verified by FakeFish.
Risk Assessment
This may lead to unintended command execution or manifest manipulation, potentially resulting in unauthorized access or configuration changes.
Recommendation
It is recommended to properly quote variables in scripts and verify BMC credentials before use.
Original NVD description (English source)
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).