CVE-2026-1531 | BDVDB-2026-313289 Detail
Red HatRed Hat Satellite 6.16 for RHEL 8
Description#
A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-295 Improper Certificate Validation
References#
- https://access.redhat.com/errata/RHSA-2026:5968
- https://access.redhat.com/errata/RHSA-2026:5970
- https://access.redhat.com/errata/RHSA-2026:5971
- https://access.redhat.com/security/cve/CVE-2026-1531
- https://bugzilla.redhat.com/show_bug.cgi?id=2433786
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1531.json
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.