CVE-2026-53470: kubev2v migration-planner improper access control in image-url endpoint

CVE-2026-53470 · Severity: critical · CVSS 9.6 · Published 2026-06-10

Migration Planner is a tool used by OpenShift to assist customers in migrating workloads. A broken access control flaw in the `/api/v1/sources/{id}/image-url` endpoint allows an authenticated attacker to download OVA (Open Virtual Appliance) files belonging to other users by bypassing ownership verification. These OVA files contain sensitive credentials including long-lived agent tokens (90-day lifetime), SSH keys, and network configuration details, enabling account takeover and unauthorized modification of victim infrastructure.

Technologies: github.com/kubev2v/migration-planner (Go), KubeVirt Migration-Planner. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-53470 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53470 being exploited in the wild.
How severe is CVE-2026-53470?
Critical severity, with a CVSS score of 9.6, published 10 June 2026.
Which products and versions are affected?
github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner < 0.13.5, unspecified.
Is there a fix for CVE-2026-53470?
Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53470 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53470?
Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later
    go get github.com/kubev2v/migration-planner@v0.13.5

Technical details

The vulnerability is a CWE-639 authorization bypass in the GetSourceDownloadURL handler at internal/handlers/v1alpha1/source.go:236. The GET /api/v1/sources/{id}/image-url endpoint generates presigned S3 URLs for OVA appliances without verifying that the requesting user owns the source, unlike sibling endpoints (GetSource, UpdateSource, DeleteSource) which perform user.Organization == source.OrgID ownership checks. Any authenticated bearer token combined with a victim's source UUID yields a valid download link. The OVA files embed 90-day-lifetime agent JWT tokens, SSH keys, proxy/network configuration, and source settings. The fix adds the same ownership verification pattern used by sibling endpoints: fetch the source, extract authenticated user credentials, verify user.Username == source.Username AND user.Organization == source.OrgID, and return 404 on authorization failure. Patched in version 0.13.5.

Affected products

  • kubev2v migration-planner < 0.13.5

Identifiers

  • CVE-2026-53470
  • GHSA-v5m8-5455-qw2x
  • GO-2026-6229

Timeline

  • 2026-06-10: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-06-07: patched: Fix merged in commit ec47a336a620f4a995f29c1c53e4e4bd70a26e00
  • 2026-08-14: advisory: GitHub reviewed and published advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.