This vulnerability arises from improper neutralization of special elements used in SQL commands within migration-planner. Specifically, when processing cluster names from an uploaded RVTools .xlsx spreadsheet, malicious SQL embedded in a cell is executed due to insufficient input sanitization. The flaw enables a remote authenticated attacker to perform SQL Injection attacks that allow arbitrary file reads on the host system. This can expose sensitive data including Kubernetes service account tokens and other credentials, which could escalate to a full compromise of the SaaS environment. The vulnerability affects migration-planner versions before 0.13.5. No official remediation level or patch link is provided in the advisory, and no known exploits are reported in the wild as of the publication date.

Successful exploitation allows an authenticated remote attacker to execute arbitrary SQL commands via specially crafted spreadsheet input, resulting in arbitrary file reading on the system. This can lead to disclosure of sensitive information such as Kubernetes service account tokens and credentials. The exposure of these credentials may enable a full compromise of the SaaS environment hosting migration-planner. The CVSS v3.1 score is 9.6 (critical), reflecting high confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-53474 for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit file upload capabilities and validate or sanitize spreadsheet inputs before processing. Monitor vendor communications for updates on patches or official mitigations.