migration-planner CVE-2026-53471

Attacker must possess a valid agent JWT issued by the target migration-planner deployment (PR:L per CVSS) and the target deployment must have agent authentication enabled (Service.Auth.AgentAuthenticationEnabled = true); the attacker also needs to know or guess a victim tenant's source UUID, which is typically a UUIDv4 but may be obtainable via prior reconnaissance, support tickets, or insider knowledge. Exploitation is limited to multi-tenant deployments - in a single-tenant self-hosted install there are no foreign source IDs to target, so the practical impact collapses to the tenant's own data. No user interaction is required (UI:N) and the two vulnerable endpoints - UpdateSourceInventory and UpdateAgentStatus on the agent-API - are reachable over the network without further configuration changes.

CVSS 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a network-reachable, low-complexity attack requiring only a valid low-privileged agent token, with scope change (S:C) because crossing tenant boundaries violates a security authority - this is consistent with the described tenant-isolation collapse. The high integrity impact (I:H) and confidentiality impact (C:H) are well-justified by the ability to overwrite arbitrary tenants' inventory data and plant attacker-controlled credential URLs that victim tenants may then consume. No EPSS, KEV, or POC indicators are provided; the only evidence is the upstream PR diff, so real-world exploitation status is unknown - likely targeted rather than mass-exploited, since exploitation presupposes the attacker already controls one tenant's agent token in a shared migration-planner deployment. The realistic risk is highest for multi-tenant managed deployments (e.g., Red Hat-hosted migration assessment services); single-tenant self-hosted installs see limited blast radius because there are no other tenants to pivot into.

An attacker who has obtained any single valid agent JWT - by registering a legitimate tenant on a shared migration-planner instance, or by compromising one agent host - sends an UpdateSourceInventory or UpdateAgentStatus request to the agent-API with a source UUID belonging to a different tenant. The server validates the JWT signature, ignores the mismatch between the token's source_id claim and the request's source ID, and overwrites the victim tenant's inventory with attacker-supplied data, including malicious credential URLs that the victim's migration workflow may later fetch. The PR diff effectively serves as a structural POC, though no weaponized exploit is publicly identified at time of analysis.