by Kastro
Paper/Archive/CVE-2026-53471

CVE-2026-53471

redhat — Migration-planner: agent api ignores jwt source_id claim

EPSS 0.3%CVSS 9.6
critical.is priorityof 100
33
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 21.2.212 × 204.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

Affected

ProductAffectedFixed inSource
migration-planner< 0.13.50.13.5CNA

Scores by source

redhat (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaccess.redhat.com/security/cve/CVE-2026-53471refbugzilla.redhat.com/show_bug.cgi?id=2487070refgithub.com/kubev2v/migration-planner/pull/1213