The vulnerability CVE-2026-1530 exists in the fog-kubevirt Ruby gem used by Red Hat Satellite 6.16 for RHEL 8, where certificate validation is disabled by default. This improper certificate validation (CWE-295) enables remote attackers to conduct Man-in-the-Middle attacks, compromising confidentiality and integrity of communications between Red Hat Satellite and OpenShift. The issue affects versions >=6.16 and <6.16.7. Red Hat has issued an official security advisory (RHSA-2026:5971) providing a fixed version 6.16.7 that restores proper certificate validation and mitigates the vulnerability.

Successful exploitation allows a remote attacker to intercept and potentially modify sensitive data exchanged between Red Hat Satellite and OpenShift, leading to information disclosure and data integrity compromise. The CVSS v3.1 base score is 8.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity.

Red Hat has released an official security update in Red Hat Satellite version 6.16.7 that fixes this vulnerability by enabling proper certificate validation in fog-kubevirt. Users should apply this update promptly. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to the Red Hat advisory RHSA-2026:5971 for detailed update instructions: https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.