Summary: MITM in foreman_kubevirt due to insecure defaults Requirements to exploit: Being able to MITM traffic between Satellite and OpenShift Component affected: https://github.com/theforeman/foreman_kubevirt Version affected: <= 0.4.0 Patch available: no Version fixed (if any already): N/A CVSS (optional): N/A Impact (optional): Important Embargo: No Reason: The amount of affected systems should be low Suggested public date: dd-MMM-yyyy Acknowledgement: Evgeni Golov Steps to reproduce if available: Configure OpenShift Virtualization / KubeVirt in Satellite and don't enter anything in the CA field Mitigation if available: Explicitly set a CA Original report: this email When foreman_kubevirt configures the connection to OpenShift, it only enables `kubevirt_verify_ssl` when a CA certificate was explicitly set in the settings [1]. Normally, users would expect that the system trust store is used when no explicit CA was set. But in this case the whole verification is disabled instead.