TI-2026-50136 CVE-2026-71566
KubeVirt backend is not authenticated
Priority MEDIUM 46
FakeFish handles incoming credentials by passing them down to scripts.
openshift-metal3
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
openshift-metal3 records in CISA KEVNo openshift-metal3 vulnerabilities are listed in CISA KEV.
Records
3 records
TI-2026-50137 CVE-2026-71567
User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
Priority LOW 34
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests.
Priority LOW 24
In BMCtest, Ironic is started without authentication and TLS for the duration of the test.