REDHAT-BUG-2487070: High severity migration-planner vulnerability

Repository: migration-planner Priority: High Location: internal/handlers/v1alpha1/agent.go:39

Description: Each agent OVA carries a JWT with a sourceid claim identifying the single source it should manage. The agent-API middleware validates the JWT signature and stores claims in context, but UpdateSourceInventory and UpdateAgentStatus handlers never check these claims. They trust the source ID from the URL path/request body instead. Helper functions auth.AgentFromContext / MustHaveAgent exist but have zero call sites.

Security Impact:

Complete tenant isolation collapse on agent surface

Any valid agent token grants write capability for every tenant's source

Attacker can overwrite victim inventory, plant malicious credentialUrl, or corrupt migration assessments

Chains with f003 for full cross-tenant write from any Hybrid Cloud Console login

Fix Suggestion: Read auth.MustHaveAgent(ctx).SourceID in both handlers and return 403 when it doesn't match the target source. The 403 response types already exist in generated server code. See patches/f002.patch.