A critical (CVSS 9.6) path traversal flaw in Red Hat's assisted-migration-agent lets an unauthenticated attacker on the same LAN write arbitrary files and potentially execute code on the appliance.
What Is It
CVE-2026-53476 is a path traversal vulnerability (CWE-59, link following) in the assisted-migration-agent. By crafting a specially designed gzipped tarball, an unauthenticated attacker can bypass the agent's security checks and write arbitrary files to the system. According to Red Hat's record, this can ultimately lead to the execution of unauthorized code on the appliance. The flaw is reachable by any attacker positioned on the same local area network, with no privileges or user interaction required.
Why It Matters
The CVSS 3.1 base score is 9.6 (CRITICAL), with a vector of AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Attack complexity is low, no authentication is needed, and the scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component. Combined with high confidentiality, integrity, and availability impact, arbitrary file write leading to code execution gives an adjacent attacker a strong path to full appliance compromise.
What's Vulnerable
The affected software is assisted-migration-agent, a component in the kubev2v project. Specific affected version ranges have not yet been enumerated in the public references, so administrators should treat all deployments as potentially affected pending vendor confirmation. Exploitation requires the attacker to be on the same LAN as the appliance (attack vector: Adjacent Network).
Patch Status
A fix is tracked in the upstream repository via GitHub pull request #256 for kubev2v/assisted-migration-agent. Red Hat has assigned the issue through Bugzilla (bug 2487233) and published a CVE page. No CISA KEV entry was supplied, so there is no confirmation of active exploitation in the wild at this time. Administrators should monitor the Red Hat and upstream references and apply the corresponding fix when available.