CVE-2026-1531— Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
Possible ATT&CK Techniques 1AI
T1557 · Adversary-in-the-MiddleGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-1531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Foreman Kubevirt Plugin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Foreman Kubevirt Plugin是The Foreman开源的一个计算模块插件。 Foreman Kubevirt Plugin存在安全漏洞，该漏洞源于默认SSL验证不安全，可能导致中间人攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:0.2.0-2.el8sat ~ * | cpe:/a:redhat:satellite_capsule:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:0.2.0-2.el9sat ~ * | cpe:/a:redhat:satellite_capsule:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.14-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.1.23-0.3.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:1.2.0-0.1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:4.2.28-0.1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:2.22.3-1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.27.10-2.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:1.5.1-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.4.3-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:4.16.0.14-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.13.0-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:6.17.7-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.0.3-4.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.14-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.1.23-0.3.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:1.2.0-0.1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:4.2.28-0.1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:2.22.3-1.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.27.10-2.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:1.5.1-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.4.3-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:4.16.0.14-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.13.0-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:6.17.7-1.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.0.3-4.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:0.4.3-1.el9sat ~ * | cpe:/a:redhat:satellite_capsule:6.18::el9 | |
| Red Hat | Red Hat Satellite 6 | - | cpe:/a:redhat:satellite:6 |
II. Public POCs for CVE-2026-1531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1531
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-1531 (4)
Same Patch Batch · Red Hat · 2026-02-02 · 7 CVEs total
| CVE-2026-1761 | 8.6 HIGH | Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http r |
| CVE-2026-1530 | 8.1 HIGH | Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate va |
| CVE-2026-1757 | 6.2 MEDIUM | Libxml2: memory leak leading to local denial of service in xmllint interactive shell |
| CVE-2026-1760 | 5.3 MEDIUM | Libsoup: soupserver: denial of service via http request smuggling |
| CVE-2026-1518 | 2.7 LOW | Keycloak: blind server-side request forgery (ssrf) via ciba backchannel notification endpo |
| CVE-2025-13881 | 2.7 LOW | Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensit |
IV. Related Vulnerabilities
Same vendor: Red Hat
- CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized su - CVE-2026-1933
Samba: missing access check on reparse point operations - CVE-2026-2340
Samba: vfs_worm does not block directory modification - CVE-2026-9689
Keycloak: org.keycloak.protocol.oidc: http parameter polluti - CVE-2026-3012
Samba: group policy certificate enrollment uses http:// with
Same weakness: CWE-295
- CVE-2026-42790
nameConstraints DNS bypass via subject CommonName fallback i - CVE-2026-42791
OCSP responder certificate validity period not checked in pu - CVE-2026-42789
Non-CA certificate accepted as intermediate issuer in public - CVE-2026-44213
OpenTelemetry.Exporter.Instana bypasses TLS certificate vali - CVE-2026-42012
Gnutls: gnutls: certificate validation bypass due to imprope
V. Comments for CVE-2026-1531
No comments yet