The vulnerability CVE-2026-53474 in migration-planner arises from improper input sanitization when processing cluster names from an uploaded RVTools .xlsx file. Malicious SQL embedded within a spreadsheet cell is executed, resulting in SQL Injection. This allows an attacker with authentication to read arbitrary files on the system, potentially exposing sensitive Kubernetes tokens and credentials, which could lead to full SaaS environment compromise. The vulnerability has a CVSS 3.1 score of 9.6 (critical) with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity severely. Red Hat's advisory confirms no impact on supported Red Hat products but acknowledges the vulnerability and references a patch in migration-planner versions 0.13.5 and later.

Successful exploitation allows a remote authenticated attacker to execute arbitrary SQL commands via a crafted spreadsheet upload, leading to arbitrary file reading on the system. This can expose sensitive data such as Kubernetes service account tokens and credentials, potentially resulting in full compromise of the SaaS environment. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires attacker authentication and has low complexity to exploit.

A patch is available for migration-planner that fixes this vulnerability in versions 0.13.5 and later. Users should upgrade to version 0.13.5 or newer to remediate this issue. Red Hat's advisory states that no currently supported Red Hat products are affected, so no action is required for Red Hat customers. For other users of migration-planner, applying the official patch or update is the recommended mitigation.