Vulnerability Description
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kebev2V | Migration Assessment | < 0.13.5 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2026-53470Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487069Issue TrackingThird Party Advisory
- https://github.com/kubev2v/migration-planner/pull/1218Patch
FAQ
What is CVE-2026-53470?
CVE-2026-53470 is a vulnerability with a CVSS score of 9.6 (CRITICAL). A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker ...
How severe is CVE-2026-53470?
CVE-2026-53470 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-53470?
Check the references section above for vendor advisories and patch information. Affected products include: Kebev2V Migration Assessment.