Critical severity9.6NVD Advisory· Published Jun 10, 2026· Updated Jun 16, 2026
CVE-2026-53474
CVE-2026-53474
Description
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/kubev2v/migration-plannerGo | < 0.13.5 | 0.13.5 |
Affected products
3(expand)+ 1 more
- (no CPE)
- (no CPE)
Patches
Vulnerability mechanics
References
6- github.com/kubev2v/migration-planner/pull/1231nvdPatchWEB
- access.redhat.com/security/cve/CVE-2026-53474nvdThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-vf2h-7x3w-97frghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-53474ghsaADVISORY
- github.com/kubev2v/migration-planner/commit/6110711b1b71bb0d15348b934a490a5932b41f83ghsaWEB
News mentions
0No linked articles in our index yet.