CVE-2026-53470
Description
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
How to fix
- kebev2v migration_assessment0.13.5 or later
- github.com/kubev2v/migration-planner0.13.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kebev2v migration_assessment | v < 0.13.5 | 0.13.5 |
| github.com/kubev2v/migration-plannerGo | v < 0.13.5 | 0.13.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.