FakeFish forwards any supplied credentials directly to underlying scripts. In the original hardware setting the Baseboard Management Controller validates these credentials, but in a KubeVirt environment FakeFish relies solely on a KUBECONFIG file mounted into the container, effectively ignoring the provided username and password. This authentication bypass (CWE‑306) allows any cluster user to issue VM‑management commands—powering virtual machines on or off and mounting arbitrary CD images—even for VMs created by other users. The result is a severe loss of confidentiality, integrity, and availability for the affected virtual machines, reflected in the CVSS score of 9.3.

The flaw exists in the FakeFish component of the OpenShift Metal3 project; no specific version ranges are listed, so all releases using the original credential handling logic are impacted. Because FakeFish runs as a container inside an OpenShift cluster, the vulnerability is relevant to any cluster that employs the FakeFish integration with KubeVirt.

With a CVSS score of 9.3 the vulnerability is classified as critical. The EPSS score is not available and the flaw is not yet listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. However, the authentication bypass enables any user that can reach the FakeFish API to control VMs without elevated host privileges, making the exploit path straightforward—send a credential‑laden request and the action is performed regardless of the supplied credentials.