Executive brief
Migration Planner is a tool used by OpenShift to assist customers in migrating workloads. A broken access control flaw in the `/api/v1/sources/{id}/image-url` endpoint allows an authenticated attacker to download OVA (Open Virtual Appliance) files belonging to other users by bypassing ownership verification. These OVA files contain sensitive credentials including long-lived agent tokens (90-day lifetime), SSH keys, and network configuration details, enabling account takeover and unauthorized modification of victim infrastructure.
Technical details
The vulnerability is a CWE-639 authorization bypass in the GetSourceDownloadURL handler at internal/handlers/v1alpha1/source.go:236. The GET /api/v1/sources/{id}/image-url endpoint generates presigned S3 URLs for OVA appliances without verifying that the requesting user owns the source, unlike sibling endpoints (GetSource, UpdateSource, DeleteSource) which perform user.Organization == source.OrgID ownership checks. Any authenticated bearer token combined with a victim's source UUID yields a valid download link. The OVA files embed 90-day-lifetime agent JWT tokens, SSH keys, proxy/network configuration, and source settings. The fix adds the same ownership verification pattern used by sibling endpoints: fetch the source, extract authenticated user credentials, verify user.Username == source.Username AND user.Organization == source.OrgID, and return 404 on authorization failure. Patched in version 0.13.5.
Affected products
- kubev2v migration-planner < 0.13.5
Timeline
- 2026-06-10: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-07: patched: Fix merged in commit ec47a336a620f4a995f29c1c53e4e4bd70a26e00
- 2026-08-14: advisory: GitHub reviewed and published advisory