CVE-2026-71566

Name of the Vulnerable Software and Affected Versions FakeFish (affected versions not specified)

Description FakeFish processes incoming credentials by passing them to scripts. While this is effective for physical hardware where the Baseboard Management Controller (BMC) validates the credentials, KubeVirt relies on a mounted KUBECONFIG file and ignores the provided credentials. This flaw allows any cluster user to control virtual machines created by the FakeFish user, including powering them on or off and mounting arbitrary CD images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.