TI-2026-38556 Aliases CVE-2026-53475 GHSA-8g5p-jxp9-457c

Assisted-migration-agent: tls verification disabled on all vcenter connections

MEDIUM 42CWE-295Published 2026-06-10 · Updated 2026-06-10

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00253 16th percentileScored 2026-11-07

Fix Fixed github.com/kubev2v/assisted-migration-agent (Go): 0.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/kubev2v/assisted-migration-agent (Go)	before 0.16.0	0.16.0	Patch available	GHSA-8g5p-jxp9-457c

github.com/kubev2v/assisted-migration-agent (Go) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-8g5p-jxp9-457c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kubev2v:assisted_migration_agent::::::::	before 2026-06-10	Vulnerable	Kubev2v

cpe:2.3:a:kubev2v:assisted_migration_agent:*:*:*:*:*:*:*:* Versions before 2026-06-10 Vulnerable ·Kubev2v

Remediation

Fix · GHSA-8g5p-jxp9-457c github.com/kubev2v/assisted-migration-agent (Go) Fixed in 0.16.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-53475
2026-10-03 Alias added: GHSA-8g5p-jxp9-457c

References

Patch 1

https://github.com/kubev2v/assisted-migration-agent/pull/268

Advisory 3

Other 2

TI-2026-38557 Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences