AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-71566

Red Hat fakefish: missing authentication

Red Hat

CVE-2026-71566 · Published Aug 17, 2026 · updated Sep 1, 2026

Critical9.3
No fix yet
Red Hat advisory

FakeFish handles incoming credentials by passing them down

to scripts. This works for real hardware because in the end it's up to

the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file

mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the

user that created fakefish, power them on and off, and mount arbitrary CD

images to them.

Affected versions

PackageAffectedFixed in
fakefish
Product
<= 28f9a6bNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More Red Hat advisories

All Red Hat