Executive brief
OpenShift migration-planner is a tool used to manage cloud infrastructure migration projects, including planning, organizing sources, and tracking assessments. An authenticated user can delete all customer data across the entire multi-tenant platform by sending a single API request, causing complete data loss and rendering the service unavailable for all customers.
Technical details
The vulnerability exists in the DELETE /api/v1/sources API endpoint (internal/handlers/v1alpha1/source.go:74) which is exposed in the OpenAPI specification without proper authorization or multi-tenant filtering. When invoked, the handler calls sourceSrv.DeleteSources(ctx) which executes an unscoped raw SQL DELETE query against a shared PostgreSQL database with no organization-level scoping, administrative gating, or permission verification. Any authenticated user—regardless of their actual access level or organization—can trigger this endpoint to delete all sources, agents, and assessments across all tenants. The fix, released in version 0.13.5, removes the bulk delete endpoint entirely and requires deletion of individual sources via DELETE /api/v1/sources/{id} with proper per-record authorization checks.
Affected products
- Red Hat migration-planner < 0.13.5
Timeline
- 2026-06-10: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-08: patched: Fix committed (db4c785); version 0.13.5 released with patch