CVE-2026-53471: Migration-planner: agent api ignores jwt source_id claim
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.
Other sources
Repository: migration-planner Priority: High Location: internal/handlers/v1alpha1/agent.go:39
Description: Each agent OVA carries a JWT with a sourceid claim identifying the single source it should manage. The agent-API middleware validates the JWT signature and stores claims in context, but UpdateSourceInventory and UpdateAgentStatus handlers never check these claims. They trust the source ID from the URL path/request body instead. Helper functions auth.AgentFromContext / MustHaveAgent exist but have zero call sites.
Security Impact:
Complete tenant isolation collapse on agent surface
Any valid agent token grants write capability for every tenant's source
Attacker can overwrite victim inventory, plant malicious credentialUrl, or corrupt migration assessments
Chains with f003 for full cross-tenant write from any Hybrid Cloud Console login
Fix Suggestion: Read auth.MustHaveAgent(ctx).SourceID in both handlers and return 403 when it doesn't match the target source. The 403 response types already exist in generated server code. See patches/f002.patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
migration-plannerto a version that resolves this vulnerability.Patch patches/f002.patch - Configuration
In UpdateSourceInventory and UpdateAgentStatus handlers, call auth.MustHaveAgent(ctx).SourceID and compare it to the requested/target source ID; if they differ, return HTTP 403 using the existing generated 403 response types.
migration-planner agent API (UpdateSourceInventory and UpdateAgentStatus handlers) validate_source_id_claim = must match requested source ID
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53471?
CVE-2026-53471 has a critical severity rating of 9.6.
How do I fix CVE-2026-53471?
To fix CVE-2026-53471, ensure that the UpdateSourceInventory and UpdateAgentStatus handlers correctly validate the source_id claim in JWTs.
What are the potential impacts of CVE-2026-53471?
CVE-2026-53471 could allow an authenticated attacker to manipulate source inventories and update agent statuses without proper authorization.
Which software is affected by CVE-2026-53471?
CVE-2026-53471 affects the migration-planner and Kebev2v Migration Assessment software.
When was CVE-2026-53471 published?
CVE-2026-53471 was published on June 9, 2026.