Executive brief
OpenShift Migration Advisor is a tool that processes infrastructure assessment files to plan cluster migrations. An authenticated attacker can upload a specially crafted spreadsheet file containing malicious SQL commands hidden in cluster names, which are executed without proper sanitization. Successful exploitation allows reading of sensitive files from the server, including Kubernetes credentials and authentication tokens, potentially leading to complete compromise of the SaaS platform.
Technical details
The vulnerability is a second-order SQL injection (CWE-89) in kubev2v/migration-planner's DuckDB query builder. User-uploaded RVTools .xlsx files are parsed and cluster names are extracted via a SELECT DISTINCT query. These cluster name strings are then interpolated unescaped into approximately 27 DuckDB query templates using Go's text/template engine, allowing single-quote breakout. An attacker can embed malicious SQL such as `x' UNION SELECT read_text('/var/run/secrets/kubernetes.io/serviceaccount/token') --` into a cluster name field. Since the DuckDB worker runs in-process within the planner-api pod without sandboxing, this grants access to sensitive files including Kubernetes service account tokens, database credentials, and JWT signing keys. The attack requires prior authentication to upload a spreadsheet. A patch (version 0.13.5) applies the existing escapeSQLString() helper to all user-controlled query parameters (ClusterFilter, OSFilter, PowerStateFilter, VmIDFilter, Category) before template execution.
Affected products
- Red Hat migration-planner < 0.13.5
Timeline
- 2026-06-10: disclosed: Vulnerability disclosed and published to GitHub Advisory Database
- 2026-06-08: patched: Fix merged in PR #1231 (commit 6110711)
- 2026-06-10: advisory: CVE-2026-53474 published