CVE-2026-53472 is a stored Cross-Site Scripting (XSS) vulnerability in migration-planner caused by insufficient validation of the AgentStatusUpdate.CredentialUrl field. An authenticated attacker can inject a malicious javascript: URL that executes script code when viewed by a victim in the Hybrid Cloud Console. This can lead to unauthorized script execution within the victim's session, potentially disclosing sensitive information such as cookies or session tokens. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). Red Hat's advisory states that no currently supported Red Hat products are affected by this issue.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of the victim's session when the malicious URL is viewed, potentially leading to disclosure of sensitive information such as session cookies. This can compromise confidentiality and integrity of user data. The CVSS v3.1 score is 6.3 (medium severity), reflecting network attack vector with low attack complexity, requiring privileges and user interaction. There are no known exploits in the wild. Red Hat confirms no impact on their supported products.

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product, so no action is required for Red Hat customers at this time. For other users of migration-planner, monitor vendor advisories for patches or updates addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.