The assisted-migration-agent application contains a security flaw due to hardcoded insecure TLS connections when interacting with vCenter. This improper certificate validation allows an attacker positioned in a Man-in-the-Middle role to intercept and harvest administrator credentials for vCenter. The vulnerability is classified as critical with a CVSS 3.1 score of 9.3, reflecting high impact on confidentiality and integrity without requiring privileges or user interaction. The affected versions are those before commit b940fec9f5032a0801e994054d30e81d64b2942a. The Red Hat advisory linked does not specify an available patch or remediation, indicating patch status is not yet confirmed.

Successful exploitation allows an attacker to perform a Man-in-the-Middle attack on the TLS communication between assisted-migration-agent and vCenter, leading to the interception and compromise of vCenter administrator credentials. This can result in unauthorized access to vCenter, compromising confidentiality and integrity of the system. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-53475 for current remediation guidance. Until an official fix is available, consider restricting network access to the assisted-migration-agent and vCenter communication channels to trusted networks only to reduce exposure to MITM attacks.