EUVD-2026-36030
GHSA-vf2h-7x3w-97fr
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
Articles & Coverage 1
AnalysisAI
SQL injection in Red Hat's kubev2v migration-planner allows a remote authenticated attacker to upload a crafted RVTools .xlsx file whose cluster-name cells are interpolated unsanitized into DuckDB queries, enabling arbitrary file reads on the host. Because the tool runs as a SaaS migration assessment service, leaked Kubernetes service account tokens or other credentials can pivot to full environment compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) an authenticated account with permission to submit an RVTools .xlsx inventory file to migration-planner (PR:L per CVSS), (2) the upload flowing through any of the vulnerable query builders in pkg/duckdb_parser/builder.go that interpolate Cluster, OS, PowerState, or VmId filters (VMQuery, DatastoreQuery, NetworkQuery, HostQuery, ClusterFeaturesQuery, VMCountQuery, PowerStateCountsQuery, HostPowerStateCountsQuery, CPUTierQuery, MemoryTierQuery, NicTierQuery, ComplexityDistributionQuery, DiskSizeTierQuery, DiskComplexityTierQuery, DiskTypeSummaryQuery), and (3) the DuckDB engine retaining file-read functions such as read_blob/read_csv on the deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.6 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N indicates network-reachable, low-complexity exploitation requiring only low-privileged authentication and no user interaction, with a scope change to the underlying SaaS environment - consistent with the description's claim that file reads expose Kubernetes credentials enabling lateral movement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant user with upload rights crafts an RVTools .xlsx whose Cluster column contains a value like `x' UNION SELECT content FROM read_blob('/var/run/secrets/kubernetes.io/serviceaccount/token') --`, then uploads it through the normal assessment workflow. When migration-planner parses the spreadsheet and builds a DuckDB query against the cluster name, the injected SQL executes, returning the pod's service-account token in the query response or logs, which the attacker then uses to authenticate to the Kubernetes API and pivot across the SaaS environment. |
| Remediation | Upstream fix available (PR https://github.com/kubev2v/migration-planner/pull/1231); released patched version not independently confirmed - operators of self-hosted migration-planner should rebuild from a commit that includes the escapeSQLString wrapping of ClusterFilter, OSFilter, PowerStateFilter, and VmIDFilter in pkg/duckdb_parser/builder.go, and SaaS users should track Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-53474 and Bugzilla 2487231 for the rolled service update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable new RVTools .xlsx file uploads to the SaaS service; audit all recent file operations and query logs; rotate all Kubernetes service account credentials used by or near the migration-planner service. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Defense Unicorns UDS Identity Config versions 0.11.0 through 0.26.0 allows unauthenticated remo
Local privilege escalation and code execution in Microsoft Azure Kubernetes Service (AKS) is possible via a path travers
Privilege bypass in Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.2.x allows remote unauthenticated attackers t
{id}) or delete (DELETE /api/projects) any project on the platform, triggering cascading deletion of associated Function
Sensitive credential disclosure in Sidero Labs Omni (versions 1.3.0–1.6.5 and 1.7.0–1.7.2) allows authenticated users wi
Share
External POC / Exploit Code
Leaving vuln.today