Is CVE-2026-53469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53469 being exploited in the wild.

How severe is CVE-2026-53469?

Critical severity, with a CVSS score of 9.1, published 10 June 2026.

Which products and versions are affected?

github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner unspecified.

Is there a fix for CVE-2026-53469?

Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53469 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-53469?

Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53469: kubev2v migration-planner missing authorization in bulk delete API

Q: Is there a fix for CVE-2026-53469?

Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53469 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-53469?

Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53469 · Severity: critical · CVSS 9.1 · Published 2026-06-10

OpenShift migration-planner is a tool used to manage cloud infrastructure migration projects, including planning, organizing sources, and tracking assessments. An authenticated user can delete all customer data across the entire multi-tenant platform by sending a single API request, causing complete data loss and rendering the service unavailable for all customers.

Technologies: github.com/kubev2v/migration-planner (Go), KubeVirt Migration-Planner. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-53469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53469 being exploited in the wild.
How severe is CVE-2026-53469?: Critical severity, with a CVSS score of 9.1, published 10 June 2026.
Which products and versions are affected?: github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner unspecified.
Is there a fix for CVE-2026-53469?: Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53469 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-53469?: Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later
```
go get github.com/kubev2v/migration-planner@v0.13.5
```

Technical details

The vulnerability exists in the DELETE /api/v1/sources API endpoint (internal/handlers/v1alpha1/source.go:74) which is exposed in the OpenAPI specification without proper authorization or multi-tenant filtering. When invoked, the handler calls sourceSrv.DeleteSources(ctx) which executes an unscoped raw SQL DELETE query against a shared PostgreSQL database with no organization-level scoping, administrative gating, or permission verification. Any authenticated user—regardless of their actual access level or organization—can trigger this endpoint to delete all sources, agents, and assessments across all tenants. The fix, released in version 0.13.5, removes the bulk delete endpoint entirely and requires deletion of individual sources via DELETE /api/v1/sources/{id} with proper per-record authorization checks.

Affected products

Red Hat migration-planner < 0.13.5

Identifiers

CVE-2026-53469
GHSA-6xvf-9742-48w2
GO-2026-6224

Timeline

2026-06-10: disclosed: Published to GitHub Advisory Database and NVD
2026-06-08: patched: Fix committed (db4c785); version 0.13.5 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.