CVE-2026-53472: Migration-planner: credentialurl validator accepts javascript: urls
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.
Other sources
Repository: migration-planner Priority: Medium Location: internal/handlers/validator/rules.go:11
Description: AgentStatusUpdate.CredentialUrl field is tagged validate:"url". go-playground/validator's url rule only checks RFC-3986 well-formedness, so javascript:alert(document.cookie) passes. Value is stored in Postgres and rendered as clickable link in migration-planner-ui-app inside Hybrid Cloud Console .
Security Impact:
Backend persistence gate for stored XSS in Red Hat hybrid-cloud console
Requires agent control alone, but chains with f003→f002 for any authenticated user to plant javascript: URL in another org's source
Script execution in victim's Hybrid Cloud Console session
Fix Suggestion: Parse URL at handler and reject anything whose scheme is not http or https before reaching service layer. UI should also stop rendering this field as raw href, but backend must not store malicious payload. See patches/f001.patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the credentialurl validation in migration-planner so AgentStatusUpdate.CredentialUrl is parsed at the handler and the scheme is checked; reject anything whose scheme is not http or https before the request reaches the service layer.
migration-planner credentialurl validator (internal/handlers/validator/rules.go:11) AgentStatusUpdate.CredentialUrl scheme allowlist = Only allow schemes http and https; reject javascript: URLs - Configuration
Change the UI so it no longer renders AgentStatusUpdate.CredentialUrl as a raw clickable href; ensure the backend does not store malicious payloads.
migration-planner-ui-app (Hybrid Cloud Console) Rendering of AgentStatusUpdate.CredentialUrl as href = Do not render as raw href - Compensating control
Apply backend validation and UI rendering changes to prevent stored XSS via AgentStatusUpdate.CredentialUrl being stored in Postgres and rendered as a clickable link in the Hybrid Cloud Console migration-planner-ui-app.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53472?
CVE-2026-53472 has a medium severity score of 6.3.
How does CVE-2026-53472 impact users?
CVE-2026-53472 allows authenticated attackers to store malicious `javascript:` URLs, leading to potential Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-53472?
To address CVE-2026-53472, ensure proper validation of the `AgentStatusUpdate.CredentialUrl` field to disallow `javascript:` URLs.
Who is affected by CVE-2026-53472?
Users of the Migration-planner software who interact with the Hybrid Cloud Console are susceptible to CVE-2026-53472.
What type of vulnerability is CVE-2026-53472?
CVE-2026-53472 is classified as a Cross-Site Scripting (XSS) vulnerability.