AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-71567

Red Hat fakefish: command injection

Red Hat

CVE-2026-71567 · Published Aug 17, 2026 · updated Sep 1, 2026

High7.7
No fix yet
Red Hat advisory

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables

are injected without quoting them either into command lines or into

manifests. This mostly applies to the Image URL and BMC credentials

(which are not verified by FakeFish).

Affected versions

PackageAffectedFixed in
fakefish
Product
<= 28f9a6bNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-78

More Red Hat advisories

All Red Hat
Critical 9.9Aug 17Red Hat managedcluster-import-controller: privilege escalationCVE-2026-66795no fix yetHigh 8.8Aug 17Red Hat Advanced Cluster Management: improper privilege managementCVE-2026-70495no fix yetCritical 9.1Aug 17Red Hat acm-search-v2-rhel9. This vulnerability: code executionCVE-2026-71472no fix yetCritical 9.9Aug 17Red Hat multicloud-operators-subscription: privilege escalationCVE-2026-66792no fix yetCritical 9.3Aug 17Red Hat fakefish: missing authenticationCVE-2026-71566no fix yetHigh 7.9Aug 17Red Hat maas-api: remote code executionCVE-2026-15218no fix yet