What is the CVSS score of CVE-2026-53473?

CVE-2026-53473 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of migration-planner-ui-app are affected by CVE-2026-53473?

Attackers with authentication credentials and agent registration privileges can compromise the browsing sessions of other users in Red Hat's migration-planner-ui-app, potentially accessing sensitive…

How to fix or mitigate CVE-2026-53473?

Within 24 hours: Restrict discovery agent registration to administrative users only; audit existing agent configurations for suspicious credentialUrl values. Within 7 days: Monitor Red Hat Bugzilla (CVE-2026-53473) and security advisories for patched release; implement input validation to reject non-http(s) protocols in credentialUrl fields. Within 30 days: Deploy patched Red Hat release version once available; conduct full security review of all agent registrations; force re-authentication for users with agent access.

migration-planner-ui-app CVE-2026-53473

EUVD-2026-36029 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 redhat

GHSA-g89r-93r3-rqqp

XSS Red Hat Migration Planner Ui

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Red Hat

7.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 16, 2026 - 14:37 NVD

HIGH MEDIUM

CVSS changed

Jun 16, 2026 - 14:37 NVD

7.3 (HIGH) 5.4 (MEDIUM)

Source Code Evidence Fetched

Jun 10, 2026 - 15:03 vuln.today

Analysis Generated

Jun 10, 2026 - 15:03 vuln.today

DescriptionNVD

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's Red Hat Single Sign-On (SSO) session, potentially leading to unauthorized cross-tenant data access and API actions.

AnalysisAI

Stored cross-site scripting in Red Hat's migration-planner-ui-app (kubev2v project) allows an authenticated attacker who can register a discovery agent to inject a javascript: URI into the agent's credentialUrl field, which executes in another organizational user's browser when they click the resulting link in the UI. No public exploit identified at time of analysis, but the upstream fix (PR #750) and Red Hat Bugzilla entry confirm the issue is real and patched via a safeExternalUrl protocol allowlist. Successful exploitation hijacks the victim's Red Hat SSO session and enables cross-tenant data access and API actions.

Technical ContextAI

migration-planner-ui-app is the React/TypeScript front-end of the kubev2v migration-planner, a tool that helps assess and migrate VMware workloads onto Red Hat OpenShift Virtualization. The vulnerable code path is in src/ui/assessment/views/CreateFromOva.tsx, which rendered an anchor tag whose href was taken directly from vm.createdSource.agent.credentialUrl - an attacker-controlled string returned by the discovery agent registration API. Because React does not sanitize the href attribute, a javascript: scheme URI passes through unchanged and executes in the click handler's origin (CWE-79, Improper Neutralization of Input During Web Page Generation). The fix introduces a safeExternalUrl() helper that parses the value with the URL constructor and only returns it if the protocol is http: or https:, blocking javascript:, data:, vbscript:, file:, and ftp: schemes.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - upgrade migration-planner-ui-app to a build containing https://github.com/kubev2v/migration-planner-ui-app/pull/750, which routes credentialUrl through the new safeExternalUrl() helper that rejects any scheme other than http: or https:. For Red Hat-shipped deployments, monitor https://access.redhat.com/security/cve/CVE-2026-53473 and Bugzilla 2487107 for the exact errata and update affected migration-planner images when published. As an interim compensating control until the patched image is deployed, restrict who can register discovery agents (the attacker capability that is the precondition) to trusted operators only, and instruct organizational users not to click credentialUrl links from agents they did not provision themselves; a stronger but more disruptive option is to deploy a Content-Security-Policy that disallows inline script execution on the migration-planner UI origin, accepting that this may break other UI features that rely on inline handlers and should be tested in staging first.