CVE-2026-53473: Migration Planner UI App XSS Vulnerability

CVE-2026-53473 Overview

CVE-2026-53473 is a stored cross-site scripting (XSS) vulnerability in the migration-planner-ui-app, a component of the Red Hat Migration Toolkit for Virtualization ecosystem maintained under the kubev2v project. An attacker with permission to register a discovery agent can supply a malicious credentialUrl containing embedded JavaScript. When an organizational user clicks the rendered link in the user interface, the attacker-controlled code executes in that user's browser context. The flaw is categorized as Improper Neutralization of Input During Web Page Generation [CWE-79].

Critical Impact
Successful exploitation hijacks the victim's Red Hat Single Sign-On (SSO) session, enabling cross-tenant data access and unauthorized API calls under the victim's identity.

Affected Products

Red Hat migration-planner-ui-app
Red Hat Migration Toolkit for Virtualization deployments integrating the migration planner UI
Environments using Red Hat Single Sign-On (SSO) with the migration planner front end

Discovery Timeline

2026-06-10 - CVE-2026-53473 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53473

Vulnerability Analysis

The migration-planner-ui-app accepts a credentialUrl field when a discovery agent is registered. The UI later renders this value as a clickable link without neutralizing active content. An attacker submits a credentialUrl whose value resolves to a JavaScript payload, for example a javascript: URI or an attribute that breaks out of the link context. When a legitimate operator views the planner inventory and clicks the link, the browser executes the attacker's script under the application's origin.

Execution within that origin gives the script access to authentication cookies, tokens, and the Red Hat SSO session bound to the victim. The attacker can then issue API requests as the victim, read tenant data the victim can see, or pivot across tenants where the victim holds cross-tenant privileges.

Root Cause

The application fails to sanitize or validate the credentialUrl value before inserting it into the DOM. Untrusted input flows directly into a rendered hyperlink, allowing script-bearing URI schemes or attribute injection. The upstream fix is tracked in GitHub Pull Request #750.

Attack Vector

Exploitation is network-based and requires low privileges plus user interaction. The attacker must be able to register a discovery agent and must wait for a higher-privileged organizational user to click the malicious link. No synthetic exploit code is published; see the Red Hat CVE-2026-53473 Advisory and Red Hat Bug #2487107 Report for vendor details.

Detection Methods for CVE-2026-53473

Indicators of Compromise

Discovery agent records whose credentialUrl field contains javascript:, data:, HTML tag fragments, or event handler attributes such as onerror= or onclick=.
Outbound requests from operator browsers to attacker-controlled domains shortly after viewing the migration planner UI.
Red Hat SSO session reuse from unexpected IP addresses or user agents after a planner UI session.

Detection Strategies

Inspect stored credentialUrl values for non-https:// schemes and any markup characters (<, >, ", backticks).
Review web server and reverse proxy logs for POST requests registering discovery agents with suspicious payloads.
Correlate SSO authentication events with subsequent API calls that touch tenants the requesting user does not normally access.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the planner UI domain and alert on script-src violations.
Monitor Red Hat SSO logs for token reuse across disparate client IPs within short time windows.
Audit role assignments for accounts able to register discovery agents and review their submissions on a recurring basis.

How to Mitigate CVE-2026-53473

Immediate Actions Required

Apply the patch referenced in GitHub Pull Request #750 once available in your Red Hat-supported build.
Identify and remove any existing discovery agent records containing scripted or non-httpscredentialUrl values.
Invalidate active Red Hat SSO sessions for users who interacted with suspicious planner entries and force re-authentication.

Patch Information

Red Hat tracks the fix under CVE-2026-53473 Advisory and Bug #2487107. Update migration-planner-ui-app to the version that incorporates the upstream sanitization fix in PR #750.

Workarounds

Restrict the ability to register discovery agents to a minimal set of trusted administrators until the patch is deployed.
Enforce a strict Content Security Policy that blocks inline scripts and javascript: URIs on the planner UI origin.
Add an upstream web application firewall rule that rejects discovery agent registration payloads containing <, >, or javascript: in the credentialUrl field.

bash

# Example WAF rule (ModSecurity) to block scripted credentialUrl values
SecRule ARGS:credentialUrl "@rx (?i)(javascript:|data:text/html|<script|on\w+\s*=)" \
  "id:1005473,phase:2,deny,status:400,log,msg:'CVE-2026-53473 XSS attempt in credentialUrl'"