Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-98pd-qdf5-17b1
Vulnerability ID VCID-98pd-qdf5-17b1
Aliases CVE-2026-1531
GHSA-2qxw-7fmx-gqfm
Summary foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-295 Improper Certificate Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2026:5968
generic_textual HIGH https://access.redhat.com/errata/RHSA-2026:5968
ssvc Track https://access.redhat.com/errata/RHSA-2026:5968
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2026:5970
generic_textual HIGH https://access.redhat.com/errata/RHSA-2026:5970
ssvc Track https://access.redhat.com/errata/RHSA-2026:5970
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2026:5971
generic_textual HIGH https://access.redhat.com/errata/RHSA-2026:5971
ssvc Track https://access.redhat.com/errata/RHSA-2026:5971
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1531.json
cvssv3 8.1 https://access.redhat.com/security/cve/CVE-2026-1531
cvssv3.1 8.1 https://access.redhat.com/security/cve/CVE-2026-1531
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2026-1531
ssvc Track https://access.redhat.com/security/cve/CVE-2026-1531
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-1531
cvssv3.1 8.1 https://bugzilla.redhat.com/show_bug.cgi?id=2433786
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2433786
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2433786
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-2qxw-7fmx-gqfm
cvssv3.1 8.1 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/foreman_kubevirt/CVE-2026-1531.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/foreman_kubevirt/CVE-2026-1531.yml
cvssv3.1 8.1 https://github.com/theforeman/foreman_kubevirt
generic_textual HIGH https://github.com/theforeman/foreman_kubevirt
cvssv3.1 8.1 https://github.com/theforeman/foreman_kubevirt/commit/6c9973ee59c6fbec65f165eb9ea9dd4ebb6eeef1
generic_textual HIGH https://github.com/theforeman/foreman_kubevirt/commit/6c9973ee59c6fbec65f165eb9ea9dd4ebb6eeef1
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2026-1531
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-1531
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2026:5968
https://access.redhat.com/errata/RHSA-2026:5970
https://access.redhat.com/errata/RHSA-2026:5971
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1531.json
https://access.redhat.com/security/cve/CVE-2026-1531
https://api.first.org/data/v1/epss?cve=CVE-2026-1531
https://bugzilla.redhat.com/show_bug.cgi?id=2433786
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/foreman_kubevirt/CVE-2026-1531.yml
https://github.com/theforeman/foreman_kubevirt
https://github.com/theforeman/foreman_kubevirt/commit/6c9973ee59c6fbec65f165eb9ea9dd4ebb6eeef1
https://nvd.nist.gov/vuln/detail/CVE-2026-1531
cpe:/a:redhat:satellite:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite:6
cpe:/a:redhat:satellite:6.16::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite:6.17::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite:6.18::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.16::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_capsule:6.17::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_capsule:6.18::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_maintenance:6.16::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_maintenance:6.16::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.16::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_utils:6.17::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_utils:6.18::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:satellite_utils:6.18::el9
GHSA-2qxw-7fmx-gqfm https://github.com/advisories/GHSA-2qxw-7fmx-gqfm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2026:5968
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-02T16:26:15Z/ Found at https://access.redhat.com/errata/RHSA-2026:5968
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2026:5970
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-02T16:26:15Z/ Found at https://access.redhat.com/errata/RHSA-2026:5970
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2026:5971
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-02T16:26:15Z/ Found at https://access.redhat.com/errata/RHSA-2026:5971
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1531.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2026-1531
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-02T16:26:15Z/ Found at https://access.redhat.com/security/cve/CVE-2026-1531
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2433786
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-02T16:26:15Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2433786
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/foreman_kubevirt/CVE-2026-1531.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/theforeman/foreman_kubevirt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/theforeman/foreman_kubevirt/commit/6c9973ee59c6fbec65f165eb9ea9dd4ebb6eeef1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-1531
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01191
EPSS Score 0.00011
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:52:59.997375+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2qxw-7fmx-gqfm/GHSA-2qxw-7fmx-gqfm.json 38.0.0