by Kastro
Paper/Archive/CVE-2026-53469

CVE-2026-53469

redhat — Migration-planner: unprotected delete endpoint wipes all tenant data

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 21.6.216 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.

Affected

ProductAffectedFixed inSource
migration-planner< 0.13.50.13.5CNA

Scores by source

redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refaccess.redhat.com/security/cve/CVE-2026-53469refbugzilla.redhat.com/show_bug.cgi?id=2487065refgithub.com/kubev2v/migration-planner/pull/1227