CVE-2026-71567

EUVD-2026-60193
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables
 are injected without quoting them either into command lines or into 
manifests. This mostly applies to the Image URL and BMC credentials 
(which are not verified by FakeFish).
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-xfhv-fp7q-v2cc