CVE-2026-71567
Received Received - Intake

Command Injection in OpenShift Metal3 FakeFish

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: redhat-cnalr

Description
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71567
EUVD
EUVD-2026-60193

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openshift-metal3 fakefish 526550a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of shell variables in the openshift-metal3/fakefish project. User-controlled variables like Image URL and BMC credentials are injected without quotes into command lines or Kubernetes manifests, enabling potential command injection or arbitrary resource creation on a cluster.

Detection Guidance

Check for unquoted shell variables in scripts or manifests related to FakeFish, particularly in Image URL and BMC credentials fields. Look for scripts using variables like $IMAGE_URL or $BMC_CREDENTIALS without quotes. Review Kubernetes manifests for similar patterns.

Impact Analysis

An attacker could exploit this to manipulate cluster resources or execute commands using credentials from KUBECONFIG. This requires network access and some privileges but no user interaction. The impact is high integrity risk, potentially altering cluster state or creating unauthorized resources.

Compliance Impact

This vulnerability could lead to unauthorized resource creation or data access in a cluster, violating integrity and potentially confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Apply the patch in version 526550a or later. As a workaround, use a proxy to sanitize HTTP basic auth credentials and Image values. Ensure all user-controlled variables in scripts and manifests are properly quoted to prevent injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart