CVE-2026-53470: kebev2v migration_assessment
Vulnerability summary
CVE-2026-53470 is a critical (CVSS 9.6) vulnerability in kebev2v migration_assessment. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 10-06-2026PublishedVulnerability first disclosed.
- 10-06-2026Last modifiedVulnerability information updated.
Description
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.20 pp
From 0.28% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Github.com/kubev2v1 product
- migration-planner< 0.13.5
Kebev2v1 product
- migration_assessment< 0.13.5
2 vendors · 2 products
