A flaw in foreman_kubevirt causes the system to disable SSL verification when a Certificate Authority certificate is not explicitly configured during OpenShift connection setup. This insecure default permits an attacker who can observe traffic between a Red Hat Satellite server and an OpenShift cluster to intercept or modify the communication, resulting in disclosure or alteration of sensitive data. The vulnerability is a classic example of misconfigured cryptographic verification, classified as CWE‑295.

The issue affects Red Hat Satellite 6 and its associated components, including Satellite 6.16, 6.17, and 6.18 for both RHEL 8 and RHEL 9 platforms, as well as related capsule, maintenance and utility modules for the same versions.

With a CVSS score of 8.1, this vulnerability is considered high severity. The EPSS score is below 1 %, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a remote attacker who can intercept network traffic between the Satellite server and the OpenShift cluster; no credential compromise is needed, but the attacker must be able to position themselves on the network path to perform a man‑in‑the‑middle attack.