CVE-2026-53474: Migration-Planner SQL Injection Flaw

CVE-2026-53474 Overview

CVE-2026-53474 is a SQL injection vulnerability [CWE-89] in the migration-planner project maintained under the kubev2v organization. A remote authenticated attacker can exploit the flaw by uploading a specially crafted RVTools .xlsx file. The application fails to sanitize cluster name values read from spreadsheet cells before passing them into SQL queries. Successful exploitation allows arbitrary file reads on the host, exposing Kubernetes service account tokens and other credentials. An attacker can pivot from credential disclosure to full compromise of the SaaS environment hosting the planner.

Critical Impact
Authenticated attackers can read arbitrary files, including Kubernetes service account tokens, leading to full SaaS environment compromise.

Affected Products

kubev2v/migration-planner (upstream project)
Red Hat migration-planner distributions tracked under Bugzilla #2487231
SaaS deployments of migration-planner accepting RVTools .xlsx imports

Discovery Timeline

2026-06-10 - CVE-2026-53474 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53474

Vulnerability Analysis

The migration-planner ingests RVTools exports as .xlsx workbooks to inventory VMware clusters slated for migration. During ingestion, cluster name values are extracted from spreadsheet cells and concatenated into SQL statements without parameterization or sanitization. An authenticated user with upload privileges can embed SQL syntax inside a cell. The injected payload executes against the backend database when the planner processes the upload. The injection chain abuses database file read primitives to retrieve files from the host filesystem.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Cluster name fields parsed from .xlsx cells are treated as trusted input. The data flows directly into dynamically constructed queries, allowing attacker-controlled syntax to alter query semantics.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. The attacker crafts an .xlsx workbook with malicious SQL in a cluster name cell and submits it through the standard import endpoint. When the planner parses the workbook and runs queries against the database, the payload executes. The scope changes because the injection enables arbitrary file reads outside the database boundary. Disclosed Kubernetes service account tokens grant access to cluster APIs and downstream workloads.

No verified public proof-of-concept code is available. Refer to the GitHub Pull Request #1231 for the fix and the Red Hat Bug Report #2487231 for technical context.

Detection Methods for CVE-2026-53474

Indicators of Compromise

Uploaded .xlsx files containing SQL keywords (UNION, SELECT, LOAD_FILE, pg_read_file) inside cluster name cells
Database query logs showing concatenated cluster name values producing syntax errors or multi-statement execution
Unexpected file reads of /var/run/secrets/kubernetes.io/serviceaccount/token or /etc/ paths by the migration-planner database user
Outbound API calls from migration-planner pods to the Kubernetes control plane using stolen service account tokens

Detection Strategies

Inspect application logs for .xlsx imports correlated with database errors referencing cluster name columns
Enable verbose SQL query logging on the migration-planner backend and alert on statements containing file read functions
Audit Kubernetes API server logs for service account token usage originating from anomalous source pods or namespaces
Hash and review submitted RVTools workbooks for cells containing SQL meta-characters before ingestion

Monitoring Recommendations

Forward migration-planner application and database logs to a centralized analytics pipeline for correlation
Monitor process and file access telemetry on planner hosts for reads of credential files by database processes
Track authentication events for the migration-planner upload endpoint and flag accounts performing repeated imports

How to Mitigate CVE-2026-53474

Immediate Actions Required

Apply the upstream fix delivered in GitHub Pull Request #1231 for kubev2v/migration-planner
Rotate all Kubernetes service account tokens and credentials reachable from migration-planner pods
Restrict upload privileges to a minimal set of trusted operators until patching completes
Review historical .xlsx uploads for malicious cluster name payloads

Patch Information

The fix is tracked in GitHub Pull Request #1231 and referenced by the Red Hat CVE Advisory. The change introduces parameterized queries and input validation for cluster name fields extracted from RVTools workbooks. Consult the Red Hat Bug Report #2487231 for distribution-specific package versions.

Workarounds

Disable the RVTools .xlsx import endpoint until the patch is deployed
Run the migration-planner database under a least-privilege role with file read functions revoked
Apply Kubernetes automountServiceAccountToken: false and scoped RBAC to the planner service account to limit blast radius
Place a validating proxy or WAF rule in front of the upload endpoint to reject workbooks containing SQL meta-characters in cluster name cells

bash

# Configuration example: restrict service account token mounting
kubectl patch serviceaccount migration-planner \
  -p '{"automountServiceAccountToken": false}'

# Revoke filesystem read functions from the planner database role (PostgreSQL)
REVOKE EXECUTE ON FUNCTION pg_read_file(text) FROM migration_planner;
REVOKE EXECUTE ON FUNCTION pg_read_server_files FROM migration_planner;