CVE-2026-71567 PUBLISHED

User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

Assigner: redhat-cnalr
Reserved: 07.08.2026 Published: 17.08.2026 Updated: 17.08.2026

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	openshift-metal3
Product	fakefish
Versions	Default: unknown affected from 0 to 28f9a6b (incl.) Version 526550a is unaffected

References

https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-xfhv-fp7q-v2cc

Problem Types

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE