Junglewise Threat Intelligence

CVE-2026-1530: Red Hat fog-kubevirt disabled certificate validation MITM

CVE-2026-1530 · Severity: high · CVSS 8.1 · Published 2026-02-02

Vendors: Red Hat, RubyGems.

Executive brief

A security flaw was identified in fog-kubevirt, a component used by Red Hat Satellite to manage virtualized environments. The software fails to properly verify security certificates when communicating with OpenShift, which could allow an attacker to intercept or modify sensitive data. This could lead to the exposure of confidential information or the unauthorized alteration of system configurations.

Technical details

A vulnerability classified as Improper Certificate Validation (CWE-295) exists in the fog-kubevirt library. The root cause is the disabling of SSL/TLS certificate validation during communication between Red Hat Satellite and OpenShift environments. A remote attacker with low privileges can exploit this to perform a Man-in-the-Middle (MITM) attack, enabling the interception and potential modification of sensitive traffic. This results in a loss of both confidentiality and integrity. The issue has been addressed in rubygem-fog-kubevirt versions 1.5.1-1.el8sat and 1.5.1-1.el9sat.

Affected products

  • Red Hat Satellite 6.16, 6.17
  • Red Hat fog-kubevirt before 1.5.1-1

Timeline

  • 2026-02-02: disclosed
  • 2026-03-26: patched: Red Hat released security advisories RHSA-2026:5970 and RHSA-2026:5971.

References