Description
A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite Maintenance 6 | libcomps +1 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.2.0-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.28-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | rubygem-rubyipmi | 0.13.0-0.1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | foreman +14 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-brotli +1 | 1.2.0-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | python-django +1 | 4.2.28-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-fog-kubevirt | 1.5.1-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-foreman_kubevirt | 0.2.0-2.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-katello | 4.16.0.14-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-rubyipmi | 0.13.0-0.1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-4.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fog-kubevirt | < 1.5.1 | 1.5.1 | GHSA-m3hq-3qj8-c5fm |
Advisories 3
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- RHSA-2026:5971 Red Hat Security Advisory: Satellite 6.16.7 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:5970 Red Hat Security Advisory: Satellite 6.17.7 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
References
- RHSA-2026:5970 vendor-advisory
- RHSA-2026:5971 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1530 vdb-entry
- RHBZ#2433784 issue-tracking