What is the CVSS score of CVE-2026-53470?

CVE-2026-53470 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-53470?

Yes, a patch is available for CVE-2026-53470. Update the affected software to the latest version immediately.

Suse CVE-2026-53470

EUVD-2026-36034 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-10 redhat

GHSA-v5m8-5455-qw2x

Authentication Bypass Suse

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 15:10 vuln.today

Analysis Generated

Jun 10, 2026 - 15:10 vuln.today

CVE Published

Jun 10, 2026 - 13:55 nvd

CRITICAL 9.6

DescriptionNVD

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/{id}/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.

AnalysisAI

Authenticated users can bypass an ownership check in migration-planner’s /api/v1/sources/{id}/image-url endpoint to obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. The exposed OVA images contain long-lived JSON Web Tokens (JWTs) and source configurations, enabling an attacker to gain unauthorized access to and potentially modify the victim’s migration sources. The vulnerability has a critical CVSS score of 9.6, but no active exploitation or public exploit code is currently known and EPSS indicates a low probability of exploitation (0.03%).