What’s Vulnerable › Vulnerabilities
CVE-2026-71567: User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
- Severity: high (CVSS 7.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-17 · updated 2026-09-01
- Weakness: CWE-78
Description
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).
References
Get alerted when CVE-2026-71567 or the next vulnerability affects your stack