CVE-2026-53476
Critical
Description
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.
SeverityCritical
CVSS9.6
Exploit probability—
ProductKubev2v Assisted Migration Agent
PublishedJun 10, 2026
First seenJun 10, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Update
- kubev2v assisted_migration_agent2026-06-07 or later
- github.com/kubev2v/assisted-migration-agent0.16.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubev2v assisted_migration_agent | v < 2026-06-07 | 2026-06-07 |
| github.com/kubev2v/assisted-migration-agentGo | v < 0.16.0 | 0.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.