Refine your search

3 vulnerabilities found for by openshift-metal3

CVE-2026-71568 (GCVE-0-2026-71568)
Vulnerability from cvelistv5
Published
2026-09-17 13:46
Modified
2026-09-17 19:34
Severity ?
5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-306 - Missing authentication for critical function
Summary
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
References
Impacted products
Vendor Product Version
openshift-metal3 bmctest Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71568",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T19:34:16.588105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T19:34:27.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "bmctest",
          "repo": "https://github.com/openshift-metal3/bmctest/",
          "vendor": "openshift-metal3",
          "versions": [
            {
              "lessThanOrEqual": "9ddd432",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "status": "unaffected",
              "version": "153aefb",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In BMCtest, Ironic is started without authentication and TLS for the duration of the test.\u0026nbsp;Exploiting the problem requires winning the race with \u003ccode\u003ebmctest\u003c/code\u003e itself, which reduces the attack window and significantly increases its complexity."
            }
          ],
          "value": "In BMCtest, Ironic is started without authentication and TLS for the duration of the test.\u00a0Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing authentication for critical function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T13:46:16.878Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openshift-metal3/bmctest/security/advisories/GHSA-53vv-qh77-2hqh"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BMCtest exposes Ironic without authentication and TLS during the test",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-71568",
    "datePublished": "2026-09-17T13:46:16.878Z",
    "dateReserved": "2026-08-07T12:08:03.283Z",
    "dateUpdated": "2026-09-17T19:34:27.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71567 (GCVE-0-2026-71567)
Vulnerability from cvelistv5
Published
2026-08-17 14:39
Modified
2026-08-17 15:25
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Summary
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).
References
Impacted products
Vendor Product Version
openshift-metal3 fakefish Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T14:49:55.069770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T15:25:12.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "fakefish",
          "repo": "https://github.com/openshift-metal3/fakefish/",
          "vendor": "openshift-metal3",
          "versions": [
            {
              "lessThanOrEqual": "28f9a6b",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "status": "unaffected",
              "version": "526550a",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2026-08-13T16:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn\u0026nbsp;openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables\n are injected without quoting them either into command lines or into \nmanifests. This mostly applies to the Image URL and BMC credentials \n(which are not verified by FakeFish). \u003c/p\u003e"
            }
          ],
          "value": "In\u00a0openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables\n are injected without quoting them either into command lines or into \nmanifests. This mostly applies to the Image URL and BMC credentials \n(which are not verified by FakeFish)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T14:39:09.651Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-xfhv-fp7q-v2cc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-71567",
    "datePublished": "2026-08-17T14:39:09.651Z",
    "dateReserved": "2026-08-07T12:08:03.283Z",
    "dateUpdated": "2026-08-17T15:25:12.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71566 (GCVE-0-2026-71566)
Vulnerability from cvelistv5
Published
2026-08-17 14:22
Modified
2026-08-17 16:00
Severity ?
9.3 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
CWE
  • CWE-306 - Missing authentication for critical function
Summary
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.
References
Impacted products
Vendor Product Version
openshift-metal3 fakefish Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71566",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T16:00:04.132607Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:00:15.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "fakefish",
          "repo": "https://github.com/openshift-metal3/fakefish/",
          "vendor": "openshift-metal3",
          "versions": [
            {
              "lessThanOrEqual": "28f9a6b",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "status": "unaffected",
              "version": "526550a",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2026-08-13T16:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFakeFish handles incoming credentials by passing them down\n to scripts. This works for real hardware because in the end it\u0027s up to \nthe BMC to validate them. However, KubeVirt relies on a KUBECONFIG file \nmounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the \nuser that created fakefish, power them on and off, and mount arbitrary CD\n images to them.\u003c/p\u003e"
            }
          ],
          "value": "FakeFish handles incoming credentials by passing them down\n to scripts. This works for real hardware because in the end it\u0027s up to \nthe BMC to validate them. However, KubeVirt relies on a KUBECONFIG file \nmounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the \nuser that created fakefish, power them on and off, and mount arbitrary CD\n images to them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing authentication for critical function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T14:22:16.712Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-qpfr-jqjq-v83w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "KubeVirt backend is not authenticated",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-71566",
    "datePublished": "2026-08-17T14:22:16.712Z",
    "dateReserved": "2026-08-07T12:08:03.283Z",
    "dateUpdated": "2026-08-17T16:00:15.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}