CVE-2026-53474: Migration-planner: second-order sql injection via rvtools upload
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
Other sources
Repository: migration-planner Priority: High Location: pkg/duckdbparser/inventorybuilder.go:65 → pkg/duckdbparser/builder.go
Description: Users upload RVTools .xlsx exports which DuckDB ingests safely. The inventory builder then runs SELECT DISTINCT "Cluster" FROM vinfo to enumerate cluster names and feeds each returned string back into ~27 query templates via text/template - unescaped, inside single quotes. A spreadsheet cell like x' UNION SELECT readtext('/var/run/secrets/kubernetes.io/serviceaccount/token') -- becomes executable SQL on the second pass.
Security Impact:
DuckDB worker runs in-process inside planner-api pod without sandbox
DuckDB's readtext()/readblob() enable arbitrary file read on pod
Can access Kubernetes service-account token, Postgres credentials, agent-JWT signing key
Single tenant's xlsx upload escalates to full SaaS compromise
Fix Suggestion: Apply existing escapeSQLString() helper (already used for ClusterFeaturesQuery) to every string field of queryParams before template execution. Patch covers all 27 call sites in builder.go. Long-term: prefer DuckDB prepared statements over text/template. See patches/f007.patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
migration-plannerto a version that resolves this vulnerability.Patch patches/f007.patch - Configuration
Apply the existing escapeSQLString() helper to every string field of queryParams prior to executing text/template-based queries. Update all ~27 call sites in builder.go (and inventory_builder.go as applicable) so cluster names and other spreadsheet-derived strings are escaped before being interpolated into SQL templates.
migration-planner (pkg/duckdb_parser/inventory_builder.go, pkg/duckdb_parser/builder.go) query parameter sanitization = apply escapeSQLString() to every string field of queryParams before template execution - Configuration
As a long-term hardening, replace text/template-driven SQL assembly with DuckDB prepared statements for parameterized queries to eliminate template-based SQL injection vectors.
migration-planner (DuckDB integration) SQL execution method = use prepared statements instead of text/template
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53474?
CVE-2026-53474 has a severity rating of critical with a score of 9.6.
How do I fix CVE-2026-53474?
To mitigate CVE-2026-53474, ensure all uploads are securely sanitized and validate input before processing RVTools .xlsx files.
What type of attack is associated with CVE-2026-53474?
CVE-2026-53474 is associated with second-order SQL injection through unauthorized upload of a malicious RVTools .xlsx file.
Who can exploit CVE-2026-53474?
CVE-2026-53474 can be exploited by a remote authenticated attacker with knowledge of the system.
What are the potential impacts of exploiting CVE-2026-53474?
Exploiting CVE-2026-53474 could lead to unauthorized access to sensitive data and manipulation of the database.