The assisted-migration-agent application contains a flaw where TLS certificate validation is improperly implemented, specifically by hardcoding insecure TLS connections when communicating with vCenter. This improper certificate validation (CWE-295) enables a Man-in-the-Middle attacker to intercept and harvest vCenter administrator credentials. The vulnerability has a critical impact with a CVSS 3.1 score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), indicating network-level attack complexity with no privileges or user interaction required, and results in complete confidentiality and integrity compromise of credentials. The Red Hat advisory states that this vulnerability does not affect any currently supported Red Hat products, and no remediation level or patches are currently provided. The advisory references the assisted-migration-agent GitHub repository and Bugzilla for additional technical details.

Successful exploitation allows a Man-in-the-Middle attacker to intercept and steal vCenter administrator credentials, which can lead to unauthorized access to vCenter environments. This compromises confidentiality and integrity of credentials but does not impact availability. The vulnerability is critical due to the high privileges associated with the stolen credentials and the ease of exploitation (no user interaction or privileges required).

The vendor advisory states that this vulnerability does not affect any currently supported Red Hat products, implying no action is required for those users. No official patch or remediation guidance is currently provided. Users of the assisted-migration-agent application should monitor the vendor advisory and related project repositories for updates and patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.