What is the CVSS score of EUVD-2026-36033?

EUVD-2026-36033 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of assisted-migration-agent are affected by EUVD-2026-36033?

kubev2v assisted-migration-agent contains a critical arbitrary file write vulnerability (CVE-2026-53476) enabling unauthenticated code execution on appliances accessible via LAN.

How to fix or mitigate EUVD-2026-36033?

24 hours: Confirm kubev2v assisted-migration-agent deployments in your environment; immediately isolate affected appliances to protected networks and restrict LAN access to authorized migration sources only. 7 days: Complete risk assessment on criticality of kubev2v instances and network exposure; subscribe to vendor advisories for CVE-2026-53476 patch availability status. 30 days: Establish patch testing and deployment plan; implement network segmentation controls (see compensating_controls) pending vendor patch release.

assisted-migration-agent EUVD-2026-36033

| CVE-2026-53476 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-06-10 redhat

GHSA-7j4w-x8x8-5mvg

Path Traversal Assisted Migration Agent

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 15:09 vuln.today

Analysis Generated

Jun 10, 2026 - 15:09 vuln.today

DescriptionNVD

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

AnalysisAI

Arbitrary file write in kubev2v assisted-migration-agent allows an unauthenticated attacker on the same LAN to achieve code execution on the appliance by uploading a crafted gzipped tarball that bypasses path traversal checks via chained symlinks. The flaw resides in the VDDK tarball extraction routine (extractTarGz in internal/services/vddk.go) and has a high CVSS of 9.6 due to scope change and full CIA impact, though no public exploit has been identified at time of analysis.

Technical ContextAI

The assisted-migration-agent is part of the kubev2v project, which facilitates VM migrations to Kubernetes/KubeVirt platforms. The vulnerable component handles upload and extraction of VMware Virtual Disk Development Kit (VDDK) tarballs (e.g., VMware-vix-disklib-8.0.3-*.tar.gz). The root cause is CWE-59 (Improper Link Resolution Before File Access, aka 'Link Following'): the original extractTarGz function validated tar entry paths individually but did not resolve symlinks in parent directories before writing subsequent entries. An attacker could include a symlink entry like 'a/x -> ..' followed by a regular file 'a/x/evil.sh', causing the second write to land outside the destination directory. The fix (PR #256) calls filepath.EvalSymlinks on the parent path before each write and rejects entries whose resolved parent escapes destDir or resolves to the root destination itself.

RemediationAI

Upstream fix available (PR/commit https://github.com/kubev2v/assisted-migration-agent/pull/256); a released patched version is not independently confirmed in the provided intelligence, so consumers should pull a build that includes the PR #256 changes to internal/services/vddk.go or track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53476 for an updated package. As a compensating control until patched code is deployed, restrict network access to the agent's upload endpoint using host-based firewall rules or network policies so only trusted migration controllers on a dedicated management VLAN can reach it - this directly neutralizes the AV:A LAN-adjacency requirement at the cost of requiring network reconfiguration. Operators who can tolerate a functional outage can also temporarily disable the VDDK upload feature, accepting that VMware-to-KubeVirt migrations dependent on VDDK will fail until the patch is applied. Monitor logs for tar extraction errors and unexpected file writes outside the configured destDir as a detection backstop.