EUVD-2026-58664
GHSA-fq78-xg9g-8fwp
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Stored XSS via authenticated API write (PR:L), requires victim browser interaction (UI:R); high confidentiality loss from session context, low integrity, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.
AnalysisAI
Stored XSS in Red Hat migration-planner allows an authenticated attacker to inject a malicious javascript: URI into the AgentStatusUpdate.CredentialUrl field, which executes in a victim's browser session when viewed through the Hybrid Cloud Console. The attack enables session hijacking and sensitive data disclosure with high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
migration-planner is a Red Hat tool for hybrid cloud infrastructure migration planning. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to validate or sanitize the CredentialUrl field within AgentStatusUpdate API submissions. The application accepts javascript: scheme URIs without rejection, storing them persistently and later rendering them in the Hybrid Cloud Console as clickable or auto-evaluated links, triggering script execution in the victim's browser security context. This is a stored (persistent) XSS pattern, more dangerous than reflected XSS because the malicious payload survives until explicitly removed and can target any user who accesses the affected view.
Affected ProductsAI
Red Hat migration-planner is the affected product. Specific affected version ranges are not enumerated in the available intelligence data - the NVD and Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-53472 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2487073 should be consulted for authoritative version scope. No CPE strings were provided in the source data.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-53472 and the tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=2487073 for the vendor-released patch version - no exact fix version was included in the available intelligence, so a specific upgrade target cannot be confirmed here. As a compensating control, administrators should restrict which principals have write access to the AgentStatusUpdate API endpoint, reducing the pool of accounts that can submit CredentialUrl values. Additionally, deploying a Content Security Policy (CSP) header on the Hybrid Cloud Console that disallows javascript: URI scheme evaluation would break the exploitation chain at the rendering layer without requiring a backend patch, though CSP configuration must be validated to avoid breaking legitimate console functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today