This vulnerability in migration-planner allows an authenticated user to bypass ownership verification at the /api/v1/sources/{id}/image-url endpoint. By exploiting this improper access control, the attacker can retrieve presigned S3 URLs for Open Virtual Appliance images of other users. These images contain sensitive information including long-lived JSON Web Tokens and source configuration data, which could lead to unauthorized access and modification of the victim's source environment. The vulnerability affects all versions prior to 0.13.5. The product is a cloud service, and the vendor (Red Hat) manages remediation for this cloud-hosted service. The CVSS v3.1 base score is 9.6, indicating critical severity.

Successful exploitation allows an authenticated attacker to access sensitive OVA images of other users, exposing long-lived JWTs and source configurations. This exposure can lead to unauthorized access and modification of victim sources, compromising confidentiality and integrity. The vulnerability does not impact availability. The high CVSS score reflects the critical impact on confidentiality and integrity with low attack complexity and no user interaction required.

A patch is available for this vulnerability in migration-planner version 0.13.5 and later. Since this is a cloud-hosted service, Red Hat manages remediation server-side. Users should verify with the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53470 for the latest remediation status and ensure their service is updated to a fixed version. No additional mitigation steps are indicated by the vendor advisory.