A critical SQL injection flaw in the kubev2v migration-planner lets an authenticated attacker read arbitrary files—including Kubernetes credentials—by uploading a crafted RVTools spreadsheet, potentially leading to full SaaS environment compromise.
What Is It
CVE-2026-53474 is a SQL injection vulnerability (CWE-89) in migration-planner. A remote authenticated attacker can exploit it by uploading a specially crafted RVTools .xlsx file. Because of improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. The injection enables arbitrary file reading on the underlying system.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.6 (CRITICAL), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The network-reachable, low-complexity attack requires only low privileges and no user interaction, and its changed scope reflects impact beyond the vulnerable component. Successful exploitation can expose sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
What's Vulnerable
The affected software is migration-planner (kubev2v). The vulnerable processing path is the handling of cluster names parsed from an uploaded RVTools .xlsx file, where unsanitized spreadsheet cell content is executed as SQL. No specific affected version ranges or CPEs are listed in the NVD record at the time of writing; readers can confirm the current status directly on the NVD detail page linked below.
Patch Status
As of the supplied data, the NVD record is in "Awaiting Analysis" status—a state readers can verify on the linked NVD page, which is also where affected version ranges and CPEs would appear once analysis completes. A fix is referenced via the project's GitHub pull request (kubev2v/migration-planner #1231) and tracked by Red Hat. No CISA KEV entry was supplied, so active exploitation is not confirmed in this source material, and no required remediation action is specified beyond applying the vendor fix.
Sources
- NVD, CVE-2026-53474: https://nvd.nist.gov/vuln/detail/CVE-2026-53474
- Red Hat Security; CVE-2026-53474: https://access.redhat.com/security/cve/CVE-2026-53474
- Red Hat Bugzilla #2487231: https://bugzilla.redhat.com/show_bug.cgi?id=2487231
- GitHub; kubev2v/migration-planner PR #1231: https://github.com/kubev2v/migration-planner/pull/1231