Read the docs
TI-2026-38557 Aliases CVE-2026-53476GHSA-7j4w-x8x8-5mvg

Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write

Priority MEDIUM 43CWE-59Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed github.com/kubev2v/assisted-migration-agent (Go): 0.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/kubev2v/assisted-migration-agent (Go)before 0.16.00.16.0Patch availableGHSA-7j4w-x8x8-5mvg
  • github.com/kubev2v/assisted-migration-agent (Go) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-7j4w-x8x8-5mvg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubev2v:assisted_migration_agent:*:*:*:*:*:*:*:*before 2026-06-07VulnerableKubev2v
  • cpe:2.3:a:kubev2v:assisted_migration_agent:*:*:*:*:*:*:*:* Versions before 2026-06-07 Vulnerable ·Kubev2v

Remediation

  • Fix · GHSA-7j4w-x8x8-5mvg github.com/kubev2v/assisted-migration-agent (Go) Fixed in 0.16.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53476
  2. 2026-10-03 Alias added: GHSA-7j4w-x8x8-5mvg

References

Patch 1

Advisory 3

Other 2

  • TI-2026-38556 Assisted-migration-agent: tls verification disabled on all vcenter connections CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences