Export limit exceeded: 395618 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 27539 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71568 | 1 Openshift-metal3 | 1 Bmctest | 2026-09-18 | 5.3 Medium |
| In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity. | ||||
| CVE-2026-71566 | 1 Openshift-metal3 | 1 Fakefish | 2026-08-21 | 9.3 Critical |
| FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them. | ||||
| CVE-2026-71567 | 1 Openshift-metal3 | 1 Fakefish | 2026-08-21 | 7.7 High |
| In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish). | ||||
Page 1 of 1.