The vulnerability arises when shell variables are inserted into command lines and Kubernetes manifests without quoting. Because the input for image URLs and BMC credentials is not validated, an attacker can inject shell commands or alter the manifest content, potentially allowing execution of arbitrary code on the host or in containers. This flaw is described as a command injection flaw (CWE‑78).

The affected product is the OpenShift Metal3 FakeFish component. No specific version information is listed in the advisory, so all deployed instances of FakeFish may be impacted until patched.

The CVSS score of 7.7 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploits yet. However, because the flaw allows an attacker who supplies untrusted image URLs or credentials to inject shell commands, it is likely an exploitable local or remote vector depending on the attacker’s ability to influence these inputs. The lack of input validation means the risk remains significant until mitigated.