CVE-2026-71566
Received Received - Intake

FakeFish Credential Handling Bypass in KubeVirt

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: redhat-cnalr

Description
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71566
EUVD
EUVD-2026-60205

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openshift-metal3 fakefish *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71566 is a vulnerability in FakeFish where credentials are passed to scripts but ignored by KubeVirt, which relies on a KUBECONFIG file. This allows any cluster user to control virtual machines created by the FakeFish user, including powering them on or off and mounting arbitrary CD images.

Detection Guidance

Detecting CVE-2026-71566 requires checking if FakeFish is running without credential validation in a KubeVirt environment. Inspect running FakeFish instances for missing --validate-credentials flags or credentials file mounts. Verify KubeVirt VM control permissions for unauthorized users.

Impact Analysis

This vulnerability allows any user in the cluster to take control of your virtual machines, power them on or off, and attach malicious CD images. This could lead to unauthorized access, data breaches, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and control of virtual machines, potentially violating data protection requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data access, or loss of control over sensitive systems.

Mitigation Strategies

Apply patches by providing --validate-credentials or mounting a credentials file. Alternatively, add an authentication proxy to the KubeVirt backend to enforce authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart