CVE-2026-53474
Critical
Description
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
SeverityCritical
CVSS9.6
Exploit probability23. percentile0.3%
ProductKebev2v Migration Assessment
PublishedJun 10, 2026
First seenJun 10, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- kebev2v migration_assessment0.13.5 or later
- github.com/kubev2v/migration-planner0.13.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kebev2v migration_assessment | v < 0.13.5 | 0.13.5 |
| github.com/kubev2v/migration-plannerGo | v < 0.13.5 | 0.13.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.