CVE-2026-71567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71567
Aliases
  • GHSA-xfhv-fp7q-v2cc
Published
2026-08-17T14:39:09Z
Modified
2026-10-28T02:30:48Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
Details

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

Database specific 
{
    "cna_assigner":  "redhat-cnalr",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71567.json"
}
References

Affected packages

Git / github.com/openshift-metal3/fakefish/

Affected ranges

Type
GIT
Repo
https://github.com/openshift-metal3/fakefish/
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
28f9a6b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "28f9a6b"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71567.json"