CVE-2026-71566

Critical

Description

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

SeverityCritical

CVSS9.3

Exploit probability—

ProductOpenshift-metal3 Fakefish

PublishedAug 17, 2026

First seenAug 17, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Vendor advisories

github.com/openshift-metal3/fakefish/security/advisories/GHSA-qpfr-jqjq-v83w

Affected products

Product	Affected versions	Fixed in
openshift-metal3 fakefish	v ≤ 28f9a6b	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.