External risk intelligence

FakeFish Arbitrary VM Control via KubeVirt Misconfiguration.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71566

FakeFish is a component used in hardware management automation within cluster environments. It operates as an internal backend tool to facilitate communication between management systems and BMCs, not as an internet-facing service or edge gateway. It is typically deployed within isolated infrastructure management networks, making public internet exposure and reachability highly unlikely.

Missing Authentication

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

FakeFish, a component in hardware management automation, improperly handles credentials, potentially allowing cluster users to control virtual machines. This vulnerability means unauthorized individuals could manage VM power states and attach arbitrary CD images, impacting VM availability and integrity.

Uncontrolled VM access by cluster users.
Undermines VM integrity and availability.
Confirm exposure; assess VM control risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending crafted credentials to the FakeFish component. Because FakeFish passes these credentials to scripts without sufficient validation for KubeVirt, an authenticated user within the cluster could then control or modify virtual machines associated with the user who deployed FakeFish.

Attack starts with unauthenticated network access.
Vulnerable component passes invalid credentials to scripts.
Attackers can control or modify VMs.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any user within a Kubernetes cluster to control virtual machines (VMs) belonging to other users. Specifically, an attacker could power VMs on or off and attach arbitrary CD images to them by leveraging how FakeFish handles credentials and the KubeVirt's reliance on a mounted KUBECONFIG file.

VM control and data access.
Exploiting credential handling and KUBECONFIG.
Unauthorized VM operation and data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts KubeVirt environments relying on FakeFish for credential handling, potentially allowing unauthorized VM control. The first practical step is to identify all KubeVirt instances using FakeFish, confirm their reachability and business criticality, and then locate the accountable owner for remediation planning.

Identify KubeVirt/FakeFish deployments and owners.
Verify VM control, reachability, and criticality.
Plan risk-based remediation with relevant teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FakeFish and how is it used?

FakeFish is a specialized component used in hardware management automation. It acts as a bridge between management systems and Baseboard Management Controllers (BMCs), helping to automate tasks like powering hardware on or off. It is typically found in cluster environments where it handles the communication necessary to manage underlying physical and virtual infrastructure.

What does CWE-306 mean for CVE-2026-71566?

CWE-306 refers to a Missing Authentication for Critical Function. In the context of this vulnerability, it means that FakeFish fails to properly verify the credentials provided to it when operating within a KubeVirt environment. Because the software does not enforce the expected authentication checks, it inadvertently allows users to perform actions on virtual machines that they should not have permission to access.

How does an attacker trigger this vulnerability?

The issue is triggered when FakeFish passes credentials to scripts in a KubeVirt setup. Because the system relies on a mounted KUBECONFIG file instead of validating the incoming credentials, the authentication process is bypassed. Note that simply interacting with FakeFish does not inherently trigger this; the risk specifically manifests when the component is integrated with KubeVirt in a way that ignores proper credential validation.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the internet. FakeFish is designed as an internal backend tool for infrastructure management and is typically deployed within isolated, private management networks. You should prioritize assessing your environment if you utilize FakeFish specifically within a KubeVirt-based cluster configuration.

What should I do first to manage this risk?

Begin by auditing your cluster to identify every instance where FakeFish is deployed alongside KubeVirt. Once these instances are mapped, determine which virtual machines are managed by these specific services and confirm who owns those deployments. Focusing on these high-risk areas allows your team to plan effective security updates based on the actual criticality of the affected virtualized workloads.

References

github.com/openshift-metal3/fakefish/security/advisories/GHSA-qp…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.