A flaw in fog‑kubevirt disables certificate validation, enabling a remote attacker to intercept and alter traffic between Red Hat Satellite and OpenShift. The vulnerability permits information disclosure and tampering with sensitive data flowing over the network. It is a classic Man‑in‑the‑Middle that directly threatens the confidentiality and integrity of communications.

Red Hat Satellite 6 and its 6.16 and 6.17 releases for RHEL 8 and RHEL 9, as well as Satellite Capsule, Maintenance and Utils components at the same minor versions. The affected products are those listed under the Red Hat Satellite family as identified by the CNA.

The CVSS score of 8.1 indicates high severity. An EPSS score of less than 1 % shows a very low probability of exploitation in the wild, and the vulnerability is not currently documented in CISA’s KEV catalog. The flaw can be leveraged remotely over the network; the attacker must have access to the communication path between Satellite and OpenShift, and must be able to supply a malicious or intercepted TLS handshake. Attack steps are inferred from the description, as the exact vector is not detailed in the data.