CVE-2026-71566: KubeVirt Auth Bypass via FakeFish Credential Ignore

Overview

A critical authentication bypass vulnerability has been disclosed in KubeVirt, the Kubernetes extension for running virtual machine workloads. Tracked as CVE-2026-71566 with a CVSS score of 9.3, the flaw exists in FakeFish, KubeVirt's Baseboard Management Controller (BMC) emulator used for virtual hardware management.

Any authenticated cluster user can exploit this vulnerability to gain full administrative access to virtual machines by simply providing arbitrary credentials — which FakeFish silently ignores.

Technical Details

FakeFish is designed to handle incoming BMC credentials by forwarding them to scripts for validation against real hardware. However, when running in a KubeVirt context, FakeFish relies on a KUBECONFIG file mounted directly into the container rather than validating the provided credentials.

The result: any user of the cluster can authenticate with any username and password — including completely fabricated credentials — and FakeFish will grant access using the elevated KUBECONFIG context. The credential validation step is effectively skipped entirely.

This allows an attacker with basic cluster access to:

• Escalate privileges to administrative VM management
• Access, modify, or destroy any virtual machine managed by KubeVirt
• Pivot laterally within the cluster using the elevated BMC access
• Exfiltrate sensitive data from running VM workloads

Attack Scenario

1. Attacker has any level of authenticated access to the Kubernetes cluster
2. Attacker sends a BMC authentication request to FakeFish with arbitrary credentials (e.g., username: attacker, password: anything)
3. FakeFish ignores the credentials and authenticates using the mounted KUBECONFIG
4. Attacker gains full VM management capabilities normally reserved for cluster administrators

Affected Environments

This vulnerability specifically impacts KubeVirt deployments that:

• Use FakeFish as the BMC emulator
• Have FakeFish containers with a KUBECONFIG mounted for cluster access
• Allow regular users to interact with BMC endpoints

Remediation

Patch your KubeVirt deployment to the fixed version as soon as it is available. In the interim, consider the following mitigations:

1. Restrict BMC endpoint access to only trusted network segments or authenticated proxies
2. Audit KUBECONFIG mounts in FakeFish containers and apply least-privilege service accounts
3. Monitor for anomalous BMC authentication activity in cluster audit logs
4. Apply Kubernetes RBAC to limit which users can reach FakeFish endpoints

Severity Assessment

References

• NVD — CVE-2026-71566
• KubeVirt Project