HIGH8.1
GHSA-m3hq-3qj8-c5fm
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation
Quick fix
GHSA-m3hq-3qj8-c5fm — fog-kubevirt: upgrade to the fixed version with the command below.
bundle update fog-kubevirtDetails
A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-1530[ADVISORY]
- https://github.com/fog/fog-kubevirt/pull/168[WEB]
- https://github.com/fog/fog-kubevirt/commit/8371e9ded99f9ec3e74caf2f283836109763e450[WEB]
- https://github.com/fog/fog-kubevirt/commit/9603d79a239a0f68bedfc679cd1b65fbf6ec4753[WEB]
- https://access.redhat.com/errata/RHSA-2026:5970[WEB]
- https://access.redhat.com/errata/RHSA-2026:5971[WEB]
- https://access.redhat.com/security/cve/CVE-2026-1530[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2433784[WEB]
- https://github.com/fog/fog-kubevirt[PACKAGE]
- https://github.com/fog/fog-kubevirt/blob/8adb03e07972d6e19a7713ecf2a827aa2cfe4b9e/CHANGELOG.md?plain=1#L11[WEB]
- https://github.com/fog/fog-kubevirt/releases/tag/v1.5.1[WEB]
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fog-kubevirt/CVE-2026-1530.yml[WEB]