Openshift-metal3 vulnerabilities
We track 2 vulnerabilities in Openshift-metal3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
2vulnerabilities
1critical
1high
0exploited
8.5average CVSS score
Latest Openshift-metal3 vulnerabilities
- 7.7 High severity
fakefish: Improper Neutralization of Special Elements used in an OS Command
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verifie
- 9.3 Critical severity
fakefish: Missing Authentication for Critical Functionality
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the creden