The vulnerability exists in migration-planner's agent-API middleware where the UpdateSourceInventory and UpdateAgentStatus handlers do not validate the source_id claim within JWTs against the requested source ID. This allows an authenticated attacker possessing a valid agent token to bypass authorization controls and manipulate data belonging to other tenants, effectively collapsing tenant isolation. The flaw can lead to unauthorized overwriting of victim inventory data, insertion of malicious credential URLs, or corruption of migration assessments. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low complexity, required privileges, no user interaction, and complete confidentiality and integrity impact with no availability impact. Red Hat's advisory confirms no currently supported Red Hat products are affected. The vulnerability affects migration-planner versions before 0.13.5, for which a patch is available.

An attacker with a valid agent token can bypass tenant isolation controls, allowing unauthorized modification of data across tenants. This includes overwriting inventory data, planting malicious credential URLs, and corrupting migration assessments. The vulnerability leads to a complete collapse of tenant isolation, resulting in high confidentiality and integrity impact. There is no known active exploitation in the wild. Red Hat confirms no currently supported Red Hat products are affected.

A patch is available for migration-planner versions prior to 0.13.5. Users should upgrade to version 0.13.5 or later to remediate this vulnerability. Red Hat's advisory states that no currently supported Red Hat products are affected, so no action is required for those users. For other users of migration-planner, applying the official patch or update is the recommended mitigation.