CVE-2026-53471

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

• CWE-639

• https://access.redhat.com/security/cve/CVE-2026-53471Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487070Issue Tracking, Third Party Advisory
• https://github.com/kubev2v/migration-planner/pull/1213Patch

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53465ImageMagick is free and open-source software used for editin…6.2
• CVE-2026-53466ImageMagick is free and open-source software used for editin…6.5
• CVE-2026-53467ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-53469A flaw was found in migration-planner. An authenticated user…8.1
• CVE-2026-5347The HM Books Gallery plugin for WordPress is vulnerable to M…5.3
• CVE-2026-53470A flaw was found in migration-planner. An authenticated atta…8.1
• CVE-2026-53473A flaw was found in migration-planner-ui-app. An attacker ca…5.4
• CVE-2026-53474A flaw was found in migration-planner. A remote authenticate…6.5
• CVE-2026-53475A flaw was found in assisted-migration-agent. The applicatio…7.4
• CVE-2026-53476A flaw was found in assisted-migration-agent. An unauthentic…9.6
• CVE-2026-53478Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-53479Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2