CVE-2026-53471: KEBEV2V Migration Assessment

High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

Affected products

• KEBEV2V Migration Assessment: before 0.13.5 (fixed in 0.13.5)

Published 2026-06-10. Last modified 2026-06-17.