A critical flaw in the assisted-migration-agent hardcodes insecure TLS connections to vCenter, allowing an adjacent-network man-in-the-middle attacker to intercept and harvest vCenter administrator credentials.
What Is It
CVE-2026-53475 is a certificate-validation weakness (CWE-295) in the assisted-migration-agent, a component of the kubev2v migration tooling. The application hardcodes insecure Transport Layer Security (TLS) settings when communicating with vCenter. Because the connection does not properly validate the server certificate, an attacker positioned on the network path can intercept the traffic. The flaw carries a CVSS 3.1 base score of 9.3 (Critical), with the vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
Why It Matters
A man-in-the-middle attacker can intercept and harvest vCenter administrator credentials in transit. Captured admin credentials lead to unauthorized access to vCenter; effectively handing an attacker control over the virtualization management plane. The high confidentiality and integrity impact, combined with no required privileges or user interaction, makes this a serious exposure wherever the agent runs. The attack requires only adjacent-network access (low complexity), and the changed scope reflects that compromise extends beyond the vulnerable component to vCenter itself.
What's Vulnerable
The affected software is assisted-migration-agent (the kubev2v project). The vulnerability is triggered during the agent's communication with vCenter. The CVE was reported by Red Hat ([email protected]).
Patch Status
A fix is tracked upstream via pull request #268 in the kubev2v/assisted-migration-agent repository, and Red Hat is tracking the issue through its security advisory and Bugzilla. There is no CISA KEV entry for this CVE, and no evidence of active exploitation is present in the supplied source material. Operators should follow the upstream PR and Red Hat advisory for remediation guidance.