A missing authorization check in Red Hat's migration-planner lets any authenticated user wipe all customer data via a single DELETE request, earning a CVSS 9.1 (Critical) rating.
What Is It
CVE-2026-53469 is a missing authorization flaw (CWE-306) in migration-planner. An authenticated user can exploit the vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. Because the endpoint does not validate whether the requester is permitted to act on the targeted data, the request is processed indiscriminately.
Why It Matters
The flaw allows the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform. It carries a CVSS 3.1 base score of 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H: network-exploitable, low complexity, no user interaction, with high integrity and availability impact. While the vector lists privileges required as none, the description notes exploitation requires an authenticated user.
What's Vulnerable
The affected product is migration-planner (the kubev2v/migration-planner project). The vulnerable component is the /api/v1/sources API route. No specific affected version ranges are listed (no CPEs are enumerated). There is no KEV entry supplied for this CVE, so active exploitation is not confirmed in the provided source material.
Patch Status
The vulnerability was reported by Red Hat ([email protected]) and is tracked in Red Hat Bugzilla bug 2487065. A fix is referenced in the upstream project via GitHub pull request #1227. As of publication, the CVE status is "Awaiting Analysis." No CISA KEV required-action or due date is present in the supplied data. Administrators should consult the Red Hat advisory and apply the upstream fix.