CVE-2026-53474

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

• CWE-89

• https://access.redhat.com/security/cve/CVE-2026-53474Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487231Issue Tracking, Third Party Advisory
• https://github.com/kubev2v/migration-planner/pull/1231Patch

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53467ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-53469A flaw was found in migration-planner. An authenticated user…8.1
• CVE-2026-5347The HM Books Gallery plugin for WordPress is vulnerable to M…5.3
• CVE-2026-53470A flaw was found in migration-planner. An authenticated atta…8.1
• CVE-2026-53471A flaw was found in migration-planner. The agent-API middlew…7.7
• CVE-2026-53473A flaw was found in migration-planner-ui-app. An attacker ca…5.4
• CVE-2026-53475A flaw was found in assisted-migration-agent. The applicatio…7.4
• CVE-2026-53476A flaw was found in assisted-migration-agent. An unauthentic…9.6
• CVE-2026-53478Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-53479Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-5348The Academy LMS – WordPress LMS Plugin for Complete eLearnin…5.3
• CVE-2026-53480Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…2.7