Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
Priority LOW 37CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix Partial foreman_kubevirt (RubyGems): 0.4.3Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | 0.2.0-2.el8sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | 0.2.0-2.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.14.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.1.23-0.3.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.2.0-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.2.28-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 2.22.3-1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.27.10-2.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.5.1-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.4.3-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.16.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.13.0-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 6.17.7-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.0.3-4.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.14.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.1.23-0.3.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.2.0-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.2.28-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 2.22.3-1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.27.10-2.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.5.1-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.4.3-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.16.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.13.0-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 6.17.7-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.0.3-4.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | 0.4.3-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6 | — | — | No fix listed | CNA |
| — | foreman_kubevirt (RubyGems) | before 0.4.3 | 0.4.3 | Patch available | GHSA-2qxw-7fmx-gqfm |
- Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 0.2.0-2.el8sat Patch available CNA
- Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 0.2.0-2.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.1.23-0.3.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.0-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.2.28-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 2.22.3-1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.27.10-2.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.5.1-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.3-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.16.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.13.0-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 6.17.7-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.0.3-4.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.1.23-0.3.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.0-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.2.28-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 2.22.3-1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.27.10-2.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.5.1-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.3-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.16.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.13.0-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 6.17.7-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.0.3-4.el9sat Patch available CNA
- Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.3-1.el9sat Patch available CNA
- Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- foreman_kubevirt (RubyGems) Vendor— Affected before 0.4.3 Fixed in 0.4.3 Patch available GHSA-2qxw-7fmx-gqfm
CPE names CNA · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:satellite_capsule:6.16::el8 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite_capsule:6.16::el9 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.16::el8 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite:6.16::el8 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.16::el9 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite:6.16::el9 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite_maintenance:6.16::el9 | 6.16 | — | Red Hat |
| cpe:/a:redhat:satellite:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_maintenance:6.17::el9 | 6.17 | — | Red Hat |
- cpe:/a:redhat:satellite_capsule:6.16::el8 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite_capsule:6.16::el9 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.16::el8 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite:6.16::el8 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.16::el9 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite:6.16::el9 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite_maintenance:6.16::el9 Versions 6.16 — ·Red Hat
- cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_maintenance:6.17::el9 Versions 6.17 — ·Red Hat
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:satellite_capsule:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_capsule:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite:6 | 6 | — | Red Hat |
- cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat
Remediation
- Fix · GHSA-2qxw-7fmx-gqfm foreman_kubevirt (RubyGems) Fixed in 0.4.3 Advisory →
Red Hat 3 advisories
- RHSA-2026:5971 Released 2026-03-26 · Red Hat rating ImportantSatellite 6.16.7 Async Update
- Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.14-1.el8sat, foreman-cli-3.12.0.14-1.el8sat, foreman-debug-3.12.0.14-1.el8sat +20
- Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.14-1.el9sat, foreman-cli-3.12.0.14-1.el9sat, foreman-debug-3.12.0.14-1.el9sat +20
- RHSA-2026:5970 Released 2026-03-26 · Red Hat rating ImportantSatellite 6.17.7 Async Update
- Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.14-1.el9sat, foreman-cli-3.14.0.14-1.el9sat, foreman-debug-3.14.0.14-1.el9sat +33
- RHSA-2026:5968 Released 2026-03-26 · Red Hat rating ImportantSatellite 6.18.4 Async Update
- Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.12-1.el9sat, foreman-cli-3.16.0.12-1.el9sat, foreman-debug-3.16.0.12-1.el9sat +15
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:5971 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:5971 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:5970 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:5968 |
Not affected: 3 products
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1531
- 2026-10-03 Alias added: GHSA-2qxw-7fmx-gqfm
References
Other 5
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-1531 · CVE Program
- CVE-2026-1531 · NVD
- FIRST EPSS
- GHSA-2qxw-7fmx-gqfm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-1531 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences