A critical authentication bypass vulnerability in openshift-metal3 fakefish allows unauthorized users to gain administrative control over virtual machines.

This is an authentication bypass vulnerability (CWE-306) occurring because the component ignores provided credentials in KubeVirt environments. Any authenticated user within the cluster can bypass security checks to manipulate virtual machines, including power state control and mounting arbitrary CD images.

This flaw carries a CVSS score of 9.3, indicating a critical risk. Successful exploitation allows unauthorized actors to perform destructive actions on virtual machine infrastructure, resulting in potential service disruption, unauthorized data access, or the deployment of malicious software via mounted images.

Immediate Action: Update openshift-metal3 fakefish to the version containing the fix (commit 526550a or later).

Proactive Monitoring: Monitor cluster access logs for unauthorized attempts to interact with or modify virtual machine configurations.

Compensating Controls: Restrict access to the Kubernetes cluster and implement strict Role-Based Access Control (RBAC) to limit the number of users capable of interacting with the fakefish service.

Public Exploit Available: Unknown.

Administrators must treat this as a high-priority security update. The ability for any cluster user to manipulate virtual machines poses a significant threat to infrastructure stability and should be mitigated by applying the provided fix immediately.