CVE-2026-71566 PUBLISHED

KubeVirt backend is not authenticated

Assigner: redhat-cnalr
Reserved: 07.08.2026 Published: 17.08.2026 Updated: 17.08.2026

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
CVSS Score: 9.3

Product Status

Vendor openshift-metal3
Product fakefish
Versions Default: unknown
  • affected from 0 to 28f9a6b (incl.)
  • Version 526550a is unaffected

References

Problem Types

  • CWE-306 Missing authentication for critical function CWE