CVE-2026-71567: User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-71567?
The risk level of CVE-2026-71567 is rated as high with a severity score of 7.7.
How do I fix CVE-2026-71567?
To fix CVE-2026-71567, ensure that user-controlled variables are properly escaped before being inserted into shell scripts and Kubernetes manifests.
What type of vulnerability is CVE-2026-71567?
CVE-2026-71567 is categorized as an OS Command Injection vulnerability.
What components are affected by CVE-2026-71567?
CVE-2026-71567 affects the openshift-metal3/fakefish scripts where shell variables are not properly quoted.
What should I be aware of regarding the impact of CVE-2026-71567?
CVE-2026-71567 may lead to unauthorized command execution due to unverified BMC credentials and unescaped Image URLs.