VYPR
Get started
← All advisories
High severity8.1NVD Advisory· Published Feb 2, 2026· Updated Apr 15, 2026

CVE-2026-1530

CVE-2026-1530

Description

A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communications between Satellite and OpenShift, resulting in information disclosure and data integrity compromise.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
fog-kubevirtRubyGems
< 1.5.11.5.1

Affected products

1

Patches

2
8371e9ded99f

Release v1.5.1

https://github.com/fog/fog-kubevirtAdam GrareJan 28, 2026via ghsa
commit
2 files changed · +4 −1
  • CHANGELOG.md+3 −0 modified
    @@ -1,3 +1,6 @@
+### 1.5.1 / 2026-01-28
+* CVE-2026-1530 - Don't override @opts in create_client_from_token ([#168](https://github.com/fog/fog-kubevirt/pull/168))
+
 ### 1.5.0 / 2026-01-16
 * Fix Compute.valid? suppressing the original error ([#162](https://github.com/fog/fog-kubevirt/pull/162))
  • lib/fog/kubevirt/version.rb+1 −1 modified
    @@ -1,5 +1,5 @@
 module Fog
   module Kubevirt
-    VERSION = '1.5.0'
+    VERSION = '1.5.1'
   end
 end
9603d79a239a

Don't override `@opts` in `create_client_from_token`

https://github.com/fog/fog-kubevirtEvgeni GolovJan 28, 2026via ghsa
commit
1 file changed · +0 −10
  • lib/fog/kubevirt/compute/compute.rb+0 −10 modified
    @@ -346,16 +346,6 @@ def create_client(path)
         end
 
         def create_client_from_token(url)
-          # Prepare the TLS and authentication options that will be used for the standard Kubernetes API
-          # and also for the KubeVirt extension:
-          @opts = {
-            :ssl_options  => {
-              :verify_ssl => OpenSSL::SSL::VERIFY_NONE,
-            },
-            :auth_options => {
-              :bearer_token => @kubevirt_token
-            }
-          }
           version = detect_version(url.to_s, @opts[:ssl_options])
           key = url.path + '/' + version

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.