Is CVE-2026-1531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1531 being exploited in the wild.

How severe is CVE-2026-1531?

High severity, with a CVSS score of 8.1, published 2 February 2026.

Which products and versions are affected?

Foreman Kubevirt before 0.4.3-1; foreman_kubevirt (RubyGems) ECOSYSTEM:introduced=0,fixed=0.4.3.

Is there a fix for CVE-2026-1531?

Yes. foreman_kubevirt (RubyGems): upgrade to 0.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1531 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1531?

Check whether you run Foreman Kubevirt or foreman_kubevirt (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1531: Foreman foreman_kubevirt insecure default SSL verification

CVE-2026-1531 · Severity: high · CVSS 8.1 · Published 2026-02-02

A security flaw was found in the foreman_kubevirt plugin, which is used by Red Hat Satellite to manage OpenShift connections. The system incorrectly disables security encryption checks (SSL verification) by default if a specific certificate is not provided. This allows an attacker to intercept or modify sensitive data transmitted between the management server and the OpenShift environment.

Vendors: Foreman, RubyGems.

Quick answers

Is CVE-2026-1531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1531 being exploited in the wild.
How severe is CVE-2026-1531?: High severity, with a CVSS score of 8.1, published 2 February 2026.
Which products and versions are affected?: Foreman Kubevirt before 0.4.3-1; foreman_kubevirt (RubyGems) ECOSYSTEM:introduced=0,fixed=0.4.3.
Is there a fix for CVE-2026-1531?: Yes. foreman_kubevirt (RubyGems): upgrade to 0.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1531 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1531?: Check whether you run Foreman Kubevirt or foreman_kubevirt (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

foreman_kubevirt (RubyGems): upgrade to 0.4.3 or later
```
bundle update foreman_kubevirt
```

Technical details

The foreman_kubevirt plugin (rubygem-foreman_kubevirt) fails to enforce SSL certificate validation when a Certificate Authority (CA) certificate is not explicitly configured during the OpenShift connection setup. This results in an insecure default state (CWE-295) where the system accepts any certificate presented by the remote endpoint. A remote attacker with the ability to intercept network traffic between Red Hat Satellite and OpenShift can perform a Man-in-the-Middle (MITM) attack to disclose or alter sensitive information. The vulnerability is addressed in rubygem-foreman_kubevirt version 0.4.3-1 and subsequent Red Hat Satellite errata (RHSA-2026:5968, RHSA-2026:5970).

Affected products

Red Hat Satellite 6.16, 6.17, 6.18
Foreman foreman_kubevirt before 0.4.3-1

Identifiers

CVE-2026-1531
GHSA-2qxw-7fmx-gqfm

Timeline

2026-02-02: disclosed
2026-03-26: patched: Red Hat released security advisories RHSA-2026:5968 and RHSA-2026:5970

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.