CVE-2026-53471
Description
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.
How to fix
- kebev2v migration_assessment0.13.5 or later
- github.com/kubev2v/migration-planner0.13.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kebev2v migration_assessment | v < 0.13.5 | 0.13.5 |
| github.com/kubev2v/migration-plannerGo | v < 0.13.5 | 0.13.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.