The vulnerability in migration-planner's agent-API middleware involves improper validation of the source_id claim within JWTs used for authentication. Specifically, the UpdateSourceInventory and UpdateAgentStatus handlers do not verify that the source_id claim matches the requested source ID. This oversight enables an authenticated attacker possessing a valid agent token to manipulate data belonging to other tenants, effectively breaking tenant isolation. The vulnerability is identified as CVE-2026-53471 with a CVSS 3.1 score of 9.6, indicating critical severity. The affected versions are those prior to 0.13.5. No official remediation level or patch information is provided in the vendor advisory, but a Red Hat advisory URL is referenced for further details.

An attacker with valid agent credentials can exploit this vulnerability to perform unauthorized actions across different tenants. This includes overwriting victim inventory data, injecting malicious credential URLs, and corrupting migration assessments. The compromise of tenant isolation can lead to significant confidentiality and integrity breaches within affected environments.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53471 for current remediation guidance. Until an official fix is available, restrict access to agent tokens and monitor for suspicious activity related to source_id claims in JWTs. Avoid using affected versions prior to 0.13.5 if possible.