GitHub Advisoryadvisory · RubyGems
GHSA-m3hq-3qj8-c5fm fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation
HIGH
Official page ↗
- Aliases
- CVE-2026-1530
- Ecosystem
- RubyGems
- Packages
- fog-kubevirt
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2026-02-02
Affected packages
• RubyGems fog-kubevirt: < 1.5.1 → fixed in 1.5.1
Description
A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.
Related
Alias · CVE (1)
- CVE-2026-1530 A flaw was found in fog-kubevirt. vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-1530 advisory
- https://github.com/fog/fog-kubevirt/pull/168 web
- https://github.com/fog/fog-kubevirt/commit/8371e9ded99f9ec3e74caf2f283836109763e450 web
- https://github.com/fog/fog-kubevirt/commit/9603d79a239a0f68bedfc679cd1b65fbf6ec4753 web
- https://access.redhat.com/errata/RHSA-2026:5970 web
- https://access.redhat.com/errata/RHSA-2026:5971 web
- https://access.redhat.com/security/cve/CVE-2026-1530 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2433784 web
- https://github.com/fog/fog-kubevirt package
- https://github.com/fog/fog-kubevirt/blob/8adb03e07972d6e19a7713ecf2a827aa2cfe4b9e/CHANGELOG.md?plain=1#L11 web
- https://github.com/fog/fog-kubevirt/releases/tag/v1.5.1 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fog-kubevirt/CVE-2026-1530.yml web