CVE-2026-53471

Katalog CVE

CVSS 7.7 · High EPSS 0,51%

Kerentanan Authorization Bypass Through User-Controlled Key pada kebev2v migration assessment. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kubev2v/migration-planner/pull/1213 patch
• https://access.redhat.com/security/cve/CVE-2026-53471 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2487070 issue tracking · advisory pihak ketiga