{"cve":"CVE-2026-53470","nvd":{"published":"2026-06-10T15:16:41.567","modified":"2026-06-17T14:28:59.467","status":"Analyzed","description":"A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-639"],"references":["https://access.redhat.com/security/cve/CVE-2026-53470","https://bugzilla.redhat.com/show_bug.cgi?id=2487069","https://github.com/kubev2v/migration-planner/pull/1218"],"products":["kebev2v:migration_assessment"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-53470","score":0.0028,"percentile":0.2058,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v5m8-5455-qw2x","url":"https://osv.dev/vulnerability/GHSA-v5m8-5455-qw2x","summary":"Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs","modified":"2026-08-18T15:10:46.163809444Z","packages":[{"ecosystem":"Go","name":"github.com/kubev2v/migration-planner","purl":"pkg:golang/github.com/kubev2v/migration-planner","ranges":["<0.13.5"],"fixed":["0.13.5"]}]},{"id":"GO-2026-6229","url":"https://osv.dev/vulnerability/GO-2026-6229","summary":"Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner","modified":"2026-08-18T15:00:24.212394191Z","packages":[{"ecosystem":"Go","name":"github.com/kubev2v/migration-planner","purl":"pkg:golang/github.com/kubev2v/migration-planner","ranges":["<0.13.5"],"fixed":["0.13.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}