CVE-2026-53470

Katalog CVE

CVSS 8.1 · High EPSS 0,48%

Kerentanan Authorization Bypass Through User-Controlled Key pada kebev2v migration assessment. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kubev2v/migration-planner/pull/1218 patch
• https://access.redhat.com/security/cve/CVE-2026-53470 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2487069 issue tracking · advisory pihak ketiga