critical9.6
CVE-2026-53471
Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation
Impact
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/kubev2v/migration-planner | < 0.13.5 | 0.13.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kebev2v | Migration Assessment | before 0.13.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-2fqw-7c6r-2cq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-53471
- https://github.com/kubev2v/migration-planner/pull/1213
- https://access.redhat.com/security/cve/CVE-2026-53471
- https://bugzilla.redhat.com/show_bug.cgi?id=2487070
- https://github.com/kubev2v/migration-planner/commit/fd21a239216f5eeec635d16c72be9c033bd5d1aa