A critical improper access control flaw in Red Hat's migration-planner lets an authenticated attacker download other users' OVA images—and the long-lived JWTs inside them.
What Is It
CVE-2026-53470 is an improper access control vulnerability (CWE-639) in migration-planner. An authenticated attacker can exploit the /api/v1/sources/{id}/image-url endpoint to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. The flaw carries a CVSS 3.1 base score of 9.6 (CRITICAL), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N—network-exploitable, low complexity, requiring only low privileges and no user interaction, with a changed scope.
Why It Matters
By downloading another user's OVA image, an attacker gains access to sensitive contents including long-lived agent JSON Web Tokens (JWTs) and source configurations. With those credentials, the attacker can move to unauthorized access and modification of the victim's source. The high confidentiality and integrity impact, combined with the scope change and a 9.6 score, makes this a serious cross-tenant data exposure risk.
What's Vulnerable
The affected component is migration-planner (the kubev2v/migration-planner project), specifically the /api/v1/sources/{id}/image-url API endpoint. The NVD record lists no specific affected version CPEs at this time; the CVE remains in "Awaiting Analysis" status as of publication.
Patch Status
This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no active exploitation is confirmed in the supplied source material. A fix is tracked in the upstream project via GitHub pull request #1218. Refer to the Red Hat security advisory and the linked pull request for remediation details.