The vulnerability CVE-2026-71567 in openshift-metal3/fakefish arises from a repeated pattern in scripts where shell variables are injected into command lines or manifests without proper quoting. This improper neutralization of special elements leads to OS command injection risks, particularly involving unverified Image URL and BMC credentials. The CVSS v3.1 score is 7.7, indicating high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and causing a high impact on integrity without affecting confidentiality or availability. The affected version is exactly 0. No known exploits are reported in the wild, and no vendor-provided patch or remediation level is specified.

Successful exploitation could allow an attacker with low privileges to execute arbitrary commands on the system due to improper handling of shell variables in scripts. This impacts the integrity of the system by potentially allowing unauthorized command execution. Confidentiality and availability are not directly affected according to the CVSS vector. The vulnerability is exploitable remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the affected version (=0) of fakefish or apply manual mitigations such as ensuring proper quoting and validation of shell variables in scripts, especially for Image URL and BMC credentials. Monitor vendor channels for updates.