CVE-2026-53470 is an authorization bypass vulnerability in migration-planner versions before 0.13.5. The flaw exists in the /api/v1/sources/{id}/image-url endpoint, where access control checks are improperly implemented, allowing authenticated users to bypass ownership verification and retrieve presigned S3 URLs for Open Virtual Appliance (OVA) images of other users. These images may contain sensitive information including long-lived agent JSON Web Tokens and source configurations, which could lead to unauthorized access and modification of victim sources. The vulnerability has a CVSS v3.1 score of 9.6 (critical). The affected product is a cloud service, and remediation is managed by the vendor. Red Hat's advisory notes that this vulnerability does not affect any currently supported Red Hat product but maintains the record for completeness.

The vulnerability allows an authenticated attacker to bypass ownership checks and access presigned URLs for OVA images belonging to other users. This can expose sensitive data such as long-lived agent JWTs and source configurations, potentially enabling unauthorized access and modification of victim sources. The impact includes horizontal privilege escalation and possible unauthorized data disclosure. The CVSS score of 9.6 reflects critical severity with high confidentiality and integrity impact, but no availability impact.

A patch is available for migration-planner versions prior to 0.13.5. Since the affected product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory for confirmation of applied fixes. No additional action is required if using the cloud service as the vendor handles patching.