EUVD-2026-60193Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
OS command injection via network API with low privilege; C:L and A:L added over NVD baseline because arbitrary command execution inherently enables file reads and host disruption.
Primary rating from Vendor (74b3a70d-cca6-4d34-9789-e83b222ae3be).
CVSS VectorVendor: 74b3a70d-cca6-4d34-9789-e83b222ae3be
Lifecycle Timeline
2DescriptionCVE.org
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).
AnalysisAI
Shell command injection in openshift-metal3/fakefish allows low-privileged network-accessible attackers to execute arbitrary OS commands by supplying crafted Image URLs or BMC credential values. Unquoted shell variable expansion in FakeFish scripts passes attacker-controlled strings directly into shell command lines and Kubernetes manifests without sanitization, with the Changed scope (S:C) in the CVSS vector indicating impact extends beyond the FakeFish process to the underlying provisioning infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privileged access to the FakeFish Redfish API endpoint - consistent with PR:L in the CVSS vector - and the ability to supply a malicious Image URL or BMC credential value that reaches FakeFish's internal shell scripts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C reflects a network-reachable, low-complexity injection path requiring only low-privileged access - a meaningful risk in any Metal3 bare-metal pipeline that processes untrusted Image URLs or BMC credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the GitHub Security Advisory GHSA-xfhv-fp7q-v2cc at https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-xfhv-fp7q-v2cc and apply the upstream fix, which addresses unquoted variable expansion by properly quoting shell variables in affected scripts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all openshift-metal3/fakefish deployments and document systems accessible to low-privileged network accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today