CVE-2026-53470: Migration-planner: getsourcedownloadurl missing organization check
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/{id}/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
Other sources
Repository: migration-planner Priority: High Location: internal/handlers/v1alpha1/source.go:236
Description: GET /api/v1/sources/{id}/image-url returns presigned S3 URLs for OVA appliances. Unlike sibling endpoints (GetSource/UpdateSource/DeleteSource), this handler skips the user.Organization == source.OrgID ownership check and proceeds directly to URL generation. Any bearer token plus victim's source UUID yields a download link.
Security Impact:
OVA embeds victim's long-lived agent JWT and source configuration
Attacker gains credential to write to victim's source (when combined with f002)
Discloses proxy/network configuration
UUIDv4 entropy is insufficient when UUIDs appear in shared assessments, support tickets, browser history
Fix Suggestion: Fetch the source first, compare user.Username/user.Organization against source.Username/source.OrgID, and return 404 on mismatch (not 403 to avoid existence oracle). Long-term: wrap SourceService in an Authz decorator. See patches/f003.patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch patches/f003.patch - Configuration
Fetch the source first, compare user.Username and user.Organization against source.Username and source.OrgID, and return HTTP 404 on mismatch (not 403) before generating presigned S3 URLs.
migration-planner /api/v1/sources/{id}/image-url handler ownership_check = enforce user.Username/user.Organization == source.Username/source.OrgID; if mismatch, return 404 - Configuration
Long-term: wrap SourceService in an Authz decorator to centralize and enforce authorization checks for source-related operations (per guidance in patches/f003.patch).
migration-planner SourceService authorization_decorator = wrap SourceService in an Authz decorator - Operational
Rotate or expire any long-lived agent JWTs and other credentials that may have been embedded in OVA images; review affected sources for unauthorized changes and reissue credentials as necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53470?
The severity of CVE-2026-53470 is rated as critical with a score of 9.6.
Who is affected by CVE-2026-53470?
CVE-2026-53470 affects users of the migration-planner software who have authenticated access.
How can I fix CVE-2026-53470?
To fix CVE-2026-53470, ensure that proper access controls are implemented for the '/api/v1/sources/{id}/image-url' endpoint.
What kind of attack does CVE-2026-53470 enable?
CVE-2026-53470 enables authenticated attackers to bypass ownership checks and access presigned S3 URLs for OVA images.
What component of migration-planner is impacted by CVE-2026-53470?
CVE-2026-53470 impacts the '/api/v1/sources/{id}/image-url' endpoint of the migration-planner application.