CVE-2026-53470
Last modified
CVE-2026-53470 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kebev2v | Migration Assessment | < 0.13.5 |
References
- https://access.redhat.com/security/cve/CVE-2026-53470Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487069Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-53470?
How severe is CVE-2026-53470?
How do I fix CVE-2026-53470?
Are you affected by CVE-2026-53470?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST