Openshift-metal3 vulnerabilities
Published CVEs affecting Openshift-metal3 products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-71568
Medium · 5.3
CWE-306 Sep 17, 2026
BMCtest exposes Ironic without authentication and TLS during the test
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
CVE-2026-71567
High · 7.7
CWE-78 Aug 17, 2026
User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables
are injected without quoting them either into command lines or into
manifests. This mostly applies to the Image URL and BMC credentials
(which are not verified by FakeFish).
CVE-2026-71566
Critical · 9.3
CWE-306 Aug 17, 2026
KubeVirt backend is not authenticated
FakeFish handles incoming credentials by passing them down
to scripts. This works for real hardware because in the end it's up to
the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file
mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the
user that created fakefish, power them on and off, and mount arbitrary CD
images to them.