CVE-2026-53471
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw exists in the migration-planner where the agent-API middleware fails to properly validate the source_id claim in JWTs. This allows an authenticated attacker to manipulate data across different tenants, leading to a complete collapse of tenant isolation.
Risk Assessment
An attacker could unauthorizedly overwrite victim data, plant malicious credential URLs, or corrupt migration assessments, posing a serious threat to data security within the organization.
Recommendation
It is recommended to implement proper validation of the source_id claim in the UpdateSourceInventory and UpdateAgentStatus handlers to ensure proper tenant isolation.
Other vulnerabilities in migration-planner
See all- CVE-2026-53474Critical
A flaw was found in migration-planner that allows a remote authenticated attacker to upload a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within spreadsheet cells is executed when processing cluster names.
- CVE-2026-53470Critical
A flaw was found in migration-planner that allows an authenticated attacker to bypass access control in the `/api/v1/sources/{id}/image-url` endpoint. This flaw enables the attacker to obtain presigned S3 URLs for OVA images belonging to other users.
- CVE-2026-53469Critical
A flaw was found in migration-planner that allows an authenticated user to send a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This enables the destruction of all customer data, including sources, agents, and assessments.
- CVE-2026-53472Medium
A flaw in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.
Original NVD description (English source)
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS