VulnerabilityAwaiting Analysis

CVE-2026-71567

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests.

HIGH 7.7EPSS 0.19%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

References

https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-xfhv-fp7q-v2cc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.