CVE-2026-53470: Authorization Bypass Through User-Controlled Key
CVE-2026-53470 is an authorization bypass vulnerability in migration-planner affecting versions prior to 0.13.5. An authenticated attacker can exploit improper access control in the /api/v1/sources/{id}/image-url endpoint to bypass ownership checks and obtain presigned S3 URLs for OVA images belonging to other users. These images may contain sensitive data such as long-lived agent JWTs and source configurations, potentially enabling unauthorized access and modification of victim sources. The vulnerability has a critical severity with a CVSS score of 9.6. The affected product is a cloud service, and a patch is available.
AI Analysis
Technical Summary
This vulnerability in migration-planner allows an authenticated user to bypass access control checks on the /api/v1/sources/{id}/image-url API endpoint. By exploiting this flaw, the attacker can retrieve presigned S3 URLs for Open Virtual Appliance images owned by other users. These images contain sensitive information including long-lived JSON Web Tokens and source configuration data, which could lead to unauthorized access and modification of the victim's source environment. The issue affects all versions prior to 0.13.5. The product is cloud-hosted, and Red Hat manages remediation for this service. The vulnerability is tracked as CVE-2026-53470 with a critical CVSS 3.1 score of 9.6.
Potential Impact
Successful exploitation allows an authenticated attacker to bypass ownership verification and access presigned URLs for OVA images of other users. This exposure of sensitive data, such as long-lived agent JWTs and source configurations, can lead to unauthorized access and potential modification of victim sources. The impact includes confidentiality and integrity violations but does not affect availability.
Mitigation Recommendations
A patch is available for this vulnerability in migration-planner versions 0.13.5 and later. Since this is a cloud-hosted service, the vendor (Red Hat) manages remediation server-side. Users should verify with the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-53470 for confirmation of patch deployment and any additional mitigation steps. No further action is required if the service is fully updated by the vendor.
CVE-2026-53470: Authorization Bypass Through User-Controlled Key
Description
CVE-2026-53470 is an authorization bypass vulnerability in migration-planner affecting versions prior to 0.13.5. An authenticated attacker can exploit improper access control in the /api/v1/sources/{id}/image-url endpoint to bypass ownership checks and obtain presigned S3 URLs for OVA images belonging to other users. These images may contain sensitive data such as long-lived agent JWTs and source configurations, potentially enabling unauthorized access and modification of victim sources. The vulnerability has a critical severity with a CVSS score of 9.6. The affected product is a cloud service, and a patch is available.
CVSS v3.1
Score 9.6critical
Affected software
pkg:github/migration-plannerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in migration-planner allows an authenticated user to bypass access control checks on the /api/v1/sources/{id}/image-url API endpoint. By exploiting this flaw, the attacker can retrieve presigned S3 URLs for Open Virtual Appliance images owned by other users. These images contain sensitive information including long-lived JSON Web Tokens and source configuration data, which could lead to unauthorized access and modification of the victim's source environment. The issue affects all versions prior to 0.13.5. The product is cloud-hosted, and Red Hat manages remediation for this service. The vulnerability is tracked as CVE-2026-53470 with a critical CVSS 3.1 score of 9.6.
Potential Impact
Successful exploitation allows an authenticated attacker to bypass ownership verification and access presigned URLs for OVA images of other users. This exposure of sensitive data, such as long-lived agent JWTs and source configurations, can lead to unauthorized access and potential modification of victim sources. The impact includes confidentiality and integrity violations but does not affect availability.
Mitigation Recommendations
A patch is available for this vulnerability in migration-planner versions 0.13.5 and later. Since this is a cloud-hosted service, the vendor (Red Hat) manages remediation server-side. Users should verify with the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-53470 for confirmation of patch deployment and any additional mitigation steps. No further action is required if the service is fully updated by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-09T17:03:29.627Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-53470","vendor":"Red Hat"}]
Threat ID: 6a29799fc9170919df2daed3
Added to database: 06/10/2026, 14:50:07 UTC
Last enriched: 06/17/2026, 16:11:32 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 100
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.