Is CVE-2026-53474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53474 being exploited in the wild.

How severe is CVE-2026-53474?

Critical severity, with a CVSS score of 9.6, published 10 June 2026.

Which products and versions are affected?

github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner unspecified.

Is there a fix for CVE-2026-53474?

Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53474 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-53474?

Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53474: kubev2v migration-planner SQL injection via RVTools upload

Q: Is there a fix for CVE-2026-53474?

Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53474 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-53474?

Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53474 · Severity: critical · CVSS 9.6 · Published 2026-06-10

OpenShift Migration Advisor is a tool that processes infrastructure assessment files to plan cluster migrations. An authenticated attacker can upload a specially crafted spreadsheet file containing malicious SQL commands hidden in cluster names, which are executed without proper sanitization. Successful exploitation allows reading of sensitive files from the server, including Kubernetes credentials and authentication tokens, potentially leading to complete compromise of the SaaS platform.

Technologies: github.com/kubev2v/migration-planner (Go), KubeVirt Migration-Planner. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-53474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53474 being exploited in the wild.
How severe is CVE-2026-53474?: Critical severity, with a CVSS score of 9.6, published 10 June 2026.
Which products and versions are affected?: github.com/kubev2v/migration-planner (Go) < 0.13.5, SEMVER:introduced=0,fixed=0.13.5; KubeVirt Migration-Planner unspecified.
Is there a fix for CVE-2026-53474?: Yes. github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53474 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-53474?: Check whether you run github.com/kubev2v/migration-planner (Go) or KubeVirt Migration-Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubev2v/migration-planner (Go): upgrade to 0.13.5 or later
```
go get github.com/kubev2v/migration-planner@v0.13.5
```

Technical details

The vulnerability is a second-order SQL injection (CWE-89) in kubev2v/migration-planner's DuckDB query builder. User-uploaded RVTools .xlsx files are parsed and cluster names are extracted via a SELECT DISTINCT query. These cluster name strings are then interpolated unescaped into approximately 27 DuckDB query templates using Go's text/template engine, allowing single-quote breakout. An attacker can embed malicious SQL such as `x' UNION SELECT read_text('/var/run/secrets/kubernetes.io/serviceaccount/token') --` into a cluster name field. Since the DuckDB worker runs in-process within the planner-api pod without sandboxing, this grants access to sensitive files including Kubernetes service account tokens, database credentials, and JWT signing keys. The attack requires prior authentication to upload a spreadsheet. A patch (version 0.13.5) applies the existing escapeSQLString() helper to all user-controlled query parameters (ClusterFilter, OSFilter, PowerStateFilter, VmIDFilter, Category) before template execution.

Affected products

Red Hat migration-planner < 0.13.5

Identifiers

CVE-2026-53474
GHSA-vf2h-7x3w-97fr
GO-2026-6233

Timeline

2026-06-10: disclosed: Vulnerability disclosed and published to GitHub Advisory Database
2026-06-08: patched: Fix merged in PR #1231 (commit 6110711)
2026-06-10: advisory: CVE-2026-53474 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.