What is the CVSS score of CVE-2026-53474?

CVE-2026-53474 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of migration-planner are affected by CVE-2026-53474?

Red Hat's kubev2v migration-planner contains a critical SQL injection vulnerability that allows authenticated attackers to read arbitrary files from the SaaS infrastructure, including Kubernetes…. A patch is available.

How to fix or mitigate CVE-2026-53474?

Within 24 hours: Disable new RVTools .xlsx file uploads to the SaaS service; audit all recent file operations and query logs; rotate all Kubernetes service account credentials used by or near the migration-planner service. Within 7 days: Migrate assessment work to offline analysis using kubev2v deployed in an isolated, air-gapped environment without access to production cluster credentials; review all migration assessments conducted via SaaS since deployment for potential data exfiltration. Within 30 days: Apply vendor-released patch once Red Hat releases the fix derived from PR #1231; rebuild and validate kubev2v in production isolation before resuming SaaS-based assessments.

migration-planner CVE-2026-53474

EUVD-2026-36030 MEDIUM

SQL Injection (CWE-89)

2026-06-10 redhat

GHSA-vf2h-7x3w-97fr

SQLi Kubernetes Suse Migration Assessment

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 16, 2026 - 14:52 NVD

CRITICAL MEDIUM

CVSS changed

Jun 16, 2026 - 14:52 NVD

9.6 (CRITICAL) 6.5 (MEDIUM)

Source Code Evidence Fetched

Jun 10, 2026 - 15:04 vuln.today

Analysis Generated

Jun 10, 2026 - 15:04 vuln.today

CVE Published

Jun 10, 2026 - 13:55 nvd

CRITICAL 9.6

DescriptionNVD

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Articles & Coverage 2

News 12 New Kubernetes Vulnerabilities - 5 Critical, 7 High Severity Jun 11, 2026 News Critical SQL Injection in Kubernetes Migration Planner (kubev2v) - CVE-2026-53474 Jun 10, 2026

AnalysisAI

SQL injection in Red Hat's kubev2v migration-planner allows a remote authenticated attacker to upload a crafted RVTools .xlsx file whose cluster-name cells are interpolated unsanitized into DuckDB queries, enabling arbitrary file reads on the host. Because the tool runs as a SaaS migration assessment service, leaked Kubernetes service account tokens or other credentials can pivot to full environment compromise. No public exploit identified at time of analysis, but an upstream fix is available via PR #1231.

Technical ContextAI

migration-planner is the kubev2v project's tool for assessing VMware environments prior to migration to OpenShift/Kubernetes (KubeVirt). It ingests RVTools .xlsx exports and uses DuckDB as an embedded analytical engine to query the resulting dataset. The vulnerable code path in pkg/duckdb_parser/builder.go concatenates the Cluster, OS, PowerState, and VmId filter values - ultimately sourced from spreadsheet cells like cluster names - directly into SQL query strings instead of using parameterized queries, which is the CWE-89 root cause. DuckDB exposes file-system functions (e.g., read_csv, read_blob) that an attacker can invoke via injection to exfiltrate local files such as Kubernetes service-account tokens mounted into the pod.

RemediationAI

Upstream fix available (PR https://github.com/kubev2v/migration-planner/pull/1231); released patched version not independently confirmed - operators of self-hosted migration-planner should rebuild from a commit that includes the escapeSQLString wrapping of ClusterFilter, OSFilter, PowerStateFilter, and VmIDFilter in pkg/duckdb_parser/builder.go, and SaaS users should track Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-53474 and Bugzilla 2487231 for the rolled service update. Until the patch is deployed, restrict upload permissions to a minimal set of trusted users, reject or sanitize RVTools .xlsx files whose cluster, OS, power-state, or VM-ID columns contain SQL metacharacters (quotes, semicolons, parentheses), and constrain the migration-planner pod's service-account token to the least privilege needed (no cluster-admin, projected token audiences scoped narrowly) so file-read primitives yield less useful credentials; note that input rejection may block legitimate cluster names containing apostrophes and that token-scope reductions can break legitimate Kubernetes API calls the planner performs.