Vulnerability · Published Aug 17, 2026 · Assigned by redhat-cnalr
CVE-2026-71567User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
High 7.7
In plain English
A high-severity OS command injection in fakefish from openshift-metal3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openshift-metal3 | fakefish | 0 – through 28f9a6b |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N