CVE-2026-71566: KubeVirt backend is not authenticated
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71566?
CVE-2026-71566 has a critical severity rating of 9.3.
What software is affected by CVE-2026-71566?
CVE-2026-71566 affects KubeVirt.
How do I fix CVE-2026-71566?
To fix CVE-2026-71566, ensure proper authentication and validation mechanisms are implemented for KubeVirt credentials.
What does CVE-2026-71566 allow unauthorized users to do?
CVE-2026-71566 allows unauthorized users to access and manipulate KubeVirt resources by bypassing credential validation.
When was CVE-2026-71566 published?
CVE-2026-71566 was published on August 17, 2026.