SYS::ONLINE
Wasteland.
Briefs1674
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-53469 2026-06-10

CVE-2026-53469: Missing Authorization in migration-planner Allows Total Data Destruction

"A missing authorization check in Red Hat's migration-planner lets any authenticated user wipe all customer data via a single DELETE request, earning a CVSS 9.1 (Critical) rating."

A missing authorization check in Red Hat's migration-planner lets any authenticated user wipe all customer data via a single DELETE request, earning a CVSS 9.1 (Critical) rating.

What Is It

CVE-2026-53469 is a missing authorization flaw (CWE-306) in migration-planner. An authenticated user can exploit the vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. Because the endpoint does not validate whether the requester is permitted to act on the targeted data, the request is processed indiscriminately.

Why It Matters

The flaw allows the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform. It carries a CVSS 3.1 base score of 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H: network-exploitable, low complexity, no user interaction, with high integrity and availability impact. While the vector lists privileges required as none, the description notes exploitation requires an authenticated user.

What's Vulnerable

The affected product is migration-planner (the kubev2v/migration-planner project). The vulnerable component is the /api/v1/sources API route. No specific affected version ranges are listed (no CPEs are enumerated). There is no KEV entry supplied for this CVE, so active exploitation is not confirmed in the provided source material.

Patch Status

The vulnerability was reported by Red Hat ([email protected]) and is tracked in Red Hat Bugzilla bug 2487065. A fix is referenced in the upstream project via GitHub pull request #1227. As of publication, the CVE status is "Awaiting Analysis." No CISA KEV required-action or due date is present in the supplied data. Administrators should consult the Red Hat advisory and apply the upstream fix.

Sources