# CVE-2026-53470: kubev2v migration-planner improper access control in image-url endpoint

Source: https://junglewise.ai/threats/cve-2026-53470-kubev2v-migration-planner-improper-access-control-in-image-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-53470 · Severity: critical · CVSS 9.6 · Published 2026-06-10

Migration Planner is a tool used by OpenShift to assist customers in migrating workloads. A broken access control flaw in the `/api/v1/sources/{id}/image-url` endpoint allows an authenticated attacker to download OVA (Open Virtual Appliance) files belonging to other users by bypassing ownership verification. These OVA files contain sensitive credentials including long-lived agent tokens (90-day lifetime), SSH keys, and network configuration details, enabling account takeover and unauthorized modification of victim infrastructure.

Technologies: [github.com/kubev2v/migration-planner (Go)](https://junglewise.ai/threats/technologies/github-com-kubev2v-migration-planner), [KubeVirt Migration-Planner](https://junglewise.ai/threats/technologies/migration-planner). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-53470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53470 being exploited in the wild.

**How severe is CVE-2026-53470?** Critical severity, with a CVSS score of 9.6, published 10 June 2026.

**Which products and versions are affected?** github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner < 0.13.5, unspecified.

**Is there a fix for CVE-2026-53470?** Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53470 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53470?** Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later

  ```sh
  go get github.com/kubev2v/migration-planner@v0.13.5
  ```


## Technical details

The vulnerability is a CWE-639 authorization bypass in the GetSourceDownloadURL handler at internal/handlers/v1alpha1/source.go:236. The GET /api/v1/sources/{id}/image-url endpoint generates presigned S3 URLs for OVA appliances without verifying that the requesting user owns the source, unlike sibling endpoints (GetSource, UpdateSource, DeleteSource) which perform user.Organization == source.OrgID ownership checks. Any authenticated bearer token combined with a victim's source UUID yields a valid download link. The OVA files embed 90-day-lifetime agent JWT tokens, SSH keys, proxy/network configuration, and source settings. The fix adds the same ownership verification pattern used by sibling endpoints: fetch the source, extract authenticated user credentials, verify user.Username == source.Username AND user.Organization == source.OrgID, and return 404 on authorization failure. Patched in version 0.13.5.

## Affected products

- kubev2v migration-planner < 0.13.5

## Identifiers

- CVE-2026-53470
- GHSA-v5m8-5455-qw2x
- GO-2026-6229

## Timeline

- 2026-06-10: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-07: patched: Fix merged in commit ec47a336a620f4a995f29c1c53e4e4bd70a26e00
- 2026-08-14: advisory: GitHub reviewed and published advisory

## References

- [https://github.com/kubev2v/migration-planner/pull/1218](https://github.com/kubev2v/migration-planner/pull/1218)
- [https://access.redhat.com/security/cve/CVE-2026-53470](https://access.redhat.com/security/cve/CVE-2026-53470)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2487069](https://bugzilla.redhat.com/show_bug.cgi?id=2487069)
- [https://github.com/kubev2v/migration-planner/commit/ec47a336a620f4a995f29c1c53e4e4bd70a26e00](https://github.com/kubev2v/migration-planner/commit/ec47a336a620f4a995f29c1c53e4e4bd70a26e00)

## Related threats

- [kubev2v migration-planner SQL injection via RVTools upload](https://junglewise.ai/threats/cve-2026-53474-kubev2v-migration-planner-sql-injection-via-rvtools-upload)
- [kubev2v migration-planner broken access control in agent-API JWT validation](https://junglewise.ai/threats/cve-2026-53471-kubev2v-migration-planner-broken-access-control-in-agent-api-jwt)
- [kubev2v migration-planner missing authorization in bulk delete API](https://junglewise.ai/threats/cve-2026-53469-kubev2v-migration-planner-missing-authorization-in-bulk-delete)