Read the docs
TI-2026-38555 Aliases CVE-2026-53474GHSA-vf2h-7x3w-97fr

Migration-planner: second-order sql injection via rvtools upload

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed migration-planner: 0.13.5github.com/kubev2v/migration-planner (Go): 0.13.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—migration-plannerbefore 0.13.50.13.5Patch availableCNA
—github.com/kubev2v/migration-planner (Go)before 0.13.50.13.5Patch availableGHSA-vf2h-7x3w-97fr
  • migration-planner Vendor— Affected before 0.13.5 Fixed in 0.13.5 Patch available CNA
  • github.com/kubev2v/migration-planner (Go) Vendor— Affected before 0.13.5 Fixed in 0.13.5 Patch available GHSA-vf2h-7x3w-97fr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kebev2v:migration_assessment:*:*:*:*:*:*:*:*before 0.13.5VulnerableKebev2v
  • cpe:2.3:a:kebev2v:migration_assessment:*:*:*:*:*:*:*:* Versions before 0.13.5 Vulnerable ·Kebev2v

Remediation

  • Fix · CNA migration-planner Fixed in 0.13.5
  • Fix · GHSA-vf2h-7x3w-97fr github.com/kubev2v/migration-planner (Go) Fixed in 0.13.5 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53474
  2. 2026-10-03 Alias added: GHSA-vf2h-7x3w-97fr

References

Patch 1

Advisory 3

Other 2

  • TI-2026-38550 Migration-planner: unprotected delete endpoint wipes all tenant data CVSS 3.1CRITICAL 9.1
  • TI-2026-38552 Migration-planner: agent api ignores jwt source_id claim CVSS 3.1CRITICAL 9.6
  • TI-2026-38551 Migration-planner: getsourcedownloadurl missing organization check CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences