What is the CVSS score of CVE-2026-1530?

CVE-2026-1530 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-1530?

Within 24 hours: Identify all systems running fog-kubevirt and assess exposure in your environment; document affected applications and business criticality. Within 7 days: Implement network segmentation to restrict fog-kubevirt communications to trusted networks only and enable enhanced monitoring for suspicious TLS/SSL activities. Within 30 days: Coordinate with development teams to evaluate alternative libraries or vendor-supplied workarounds; if fog-kubevirt is business-critical, prepare upgrade plans for when a patch becomes available.

CVE-2026-1530

HIGH

Improper Certificate Validation (CWE-295)

2026-02-02 secalert@redhat.com

GHSA-m3hq-3qj8-c5fm

Information Disclosure

8.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.

AnalysisAI

Improper certificate validation in fog-kubevirt enables remote attackers with network access to conduct man-in-the-middle attacks against communications between Satellite and OpenShift clusters, potentially exposing sensitive data and modifying traffic in transit. An authenticated attacker can exploit this vulnerability to intercept and tamper with cluster management communications due to disabled SSL/TLS certificate verification. Currently no patch is available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-295 (Improper Certificate Validation). A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.