CVE-2026-53470: Migration Planner Auth Bypass Vulnerability

CVE-2026-53470 Overview

CVE-2026-53470 is an improper access control vulnerability [CWE-639] in migration-planner, an open-source project maintained by the kubev2v community. The flaw resides in the /api/v1/sources/{id}/image-url API endpoint, which fails to enforce ownership checks on source identifiers. An authenticated attacker can request presigned Amazon S3 URLs for Open Virtual Appliance (OVA) images belonging to other tenants. The downloaded OVA images contain long-lived agent JSON Web Tokens (JWTs) and source configuration data, enabling cross-tenant access and modification of victim resources.

Critical Impact
Authenticated attackers can retrieve OVA images of other users, harvest embedded long-lived JWTs, and gain unauthorized access to victim source configurations.

Affected Products

kubev2v migration-planner (upstream open-source project)
Red Hat distributions packaging migration-planner (see Red Hat CVE-2026-53470 Advisory)
Deployments exposing the /api/v1/sources/{id}/image-url endpoint to multi-tenant users

Discovery Timeline

2026-06-10 - CVE CVE-2026-53470 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53470

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) within the migration-planner REST API. The /api/v1/sources/{id}/image-url handler accepts a source identifier and returns a presigned S3 URL that points to the OVA image associated with that source. The handler authenticates the caller but does not verify that the caller owns the requested {id}. Any authenticated user can therefore enumerate or supply arbitrary source identifiers and receive presigned URLs scoped to other tenants' artifacts.

Because OVA images generated by migration-planner embed long-lived agent JWTs and source configuration material, the impact extends beyond information disclosure. An attacker who downloads a victim's OVA can extract the embedded JWT and authenticate as the victim's agent. This permits read and write operations against the victim's source, producing both confidentiality and integrity loss across tenant boundaries.

Root Cause

The handler implements authentication but omits an authorization check binding the authenticated principal to the source {id} parameter. The lookup fetches the source record and constructs a presigned URL without filtering by owner, organization, or tenant identifier. This is the canonical pattern described in CWE-639: Authorization Bypass Through User-Controlled Key. The upstream fix is tracked in GitHub Pull Request #1218.

Attack Vector

Exploitation requires only valid low-privilege credentials and network access to the migration-planner API. The attacker enumerates or guesses source identifiers and issues a GET request to /api/v1/sources/{id}/image-url. The server returns a presigned S3 URL; the attacker fetches the OVA, mounts or inspects it, and extracts the long-lived JWT from the embedded agent configuration. The recovered JWT is then replayed against the API to operate as the victim's agent.

No exploitation code is verified or required to demonstrate the issue. Refer to the Red Hat Bug Report #2487069 for the vendor-tracked technical description.

Detection Methods for CVE-2026-53470

Indicators of Compromise

API access logs showing a single authenticated principal requesting /api/v1/sources/{id}/image-url for multiple {id} values not owned by that principal.
S3 access logs recording downloads of OVA objects via presigned URLs from client IP addresses that differ from the legitimate owning tenant.
Agent JWT usage observed from new or unexpected source IP addresses after an OVA download event.
Unexplained modifications to source configurations performed by agent JWTs belonging to another tenant.

Detection Strategies

Correlate authenticated API callers with source ownership records and alert when the caller identifier does not match the source owner.
Baseline normal request rates per user against /api/v1/sources/{id}/image-url and flag enumeration patterns or sequential {id} scans.
Inspect presigned URL issuance audit trails and compare requesting principal against object ownership metadata in S3.

Monitoring Recommendations

Forward migration-planner API logs and S3 access logs to a centralized analytics platform for cross-source correlation.
Track JWT issuance and usage location, alerting on geographic or ASN drift for long-lived agent tokens.
Monitor outbound bandwidth from the migration-planner host for anomalous OVA-sized transfers.

How to Mitigate CVE-2026-53470

Immediate Actions Required

Upgrade migration-planner to a release that includes the fix from GitHub Pull Request #1218.
Rotate all long-lived agent JWTs issued prior to patching, since previously generated tokens may have been exfiltrated.
Review API and S3 access logs for unauthorized calls to /api/v1/sources/{id}/image-url and revoke tokens associated with suspicious activity.
Re-generate OVA images so newly distributed artifacts contain freshly minted credentials.

Patch Information

The upstream fix introduces an ownership check in the image URL handler so the authenticated principal must match the source owner before a presigned URL is returned. Track Red Hat package availability via the Red Hat CVE-2026-53470 Advisory and the upstream merge in GitHub Pull Request #1218.

Workarounds

Restrict network access to the migration-planner API to trusted operators until the patched build is deployed.
Shorten the lifetime of agent JWTs and rotate them on a frequent schedule to limit the value of any harvested token.
Apply per-tenant authorization at an upstream reverse proxy or API gateway when feasible, blocking requests where the authenticated identity does not match the requested source {id}.

bash

# Example reverse-proxy rule (illustrative) blocking cross-tenant
# image-url requests by enforcing a tenant claim from the JWT.
location ~ ^/api/v1/sources/(?<src_id>[^/]+)/image-url$ {
    auth_jwt_claim_set $jwt_tenant tenant;
    if ($jwt_tenant != $arg_tenant) {
        return 403;
    }
    proxy_pass http://migration_planner_upstream;
}