Bug 2433786 (CVE-2026-1531)

Summary:	CVE-2026-1531 foreman-kubevirt: foreman_kubevirt: Man-in-the-Middle due to insecure default SSL verification
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, ehelms, ggainey, juwatts, mhulan, nmoumoul, osousa, pcreech, rchan, smallamp, tmalecek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-28 12:52:16 UTC

Summary: MITM in foreman_kubevirt due to insecure defaults

Requirements to exploit: Being able to MITM traffic between Satellite
and OpenShift

Component affected: https://github.com/theforeman/foreman_kubevirt

Version affected: <= 0.4.0

Patch available: no

Version fixed (if any already): N/A

CVSS (optional): N/A

Impact (optional): Important

Embargo: No

Reason: The amount of affected systems should be low
Suggested public date: dd-MMM-yyyy

Acknowledgement: Evgeni Golov

Steps to reproduce if available:

Configure OpenShift Virtualization / KubeVirt in Satellite and don't
enter anything in the CA field
Mitigation if available: Explicitly set a CA

Original report: this email

When foreman_kubevirt configures the connection to OpenShift, it only
enables `kubevirt_verify_ssl` when a CA certificate was explicitly set
in the settings [1].
Normally, users would expect that the system trust store is used when
no explicit CA was set.
But in this case the whole verification is disabled instead.

Comment 2 errata-xmlrpc 2026-03-26 20:26:14 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:5970 https://access.redhat.com/errata/RHSA-2026:5970

Comment 3 errata-xmlrpc 2026-03-26 20:26:36 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:5971 https://access.redhat.com/errata/RHSA-2026:5971