CVE-2026-53474 Details
Description
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
A second-order SQL injection vulnerability has been identified in KubeV2V Migration Planner. This issue arises when a remote authenticated attacker uploads a specially crafted RVTools .xlsx file. The vulnerability is due to inadequate input sanitization, allowing malicious SQL embedded in spreadsheet cells to be executed during the processing of cluster names. Exploitation of this vulnerability enables arbitrary file reading from the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a complete compromise of the SaaS environment.
The vulnerability has been addressed in a patch that escapes SQL string fields in the query builder to prevent the injection. This patch is available in the main branch of the KubeV2V Migration Planner GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-53474 | [email protected] | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2487231 | [email protected] | Issue TrackingThird Party Advisory |
| https://github.com/kubev2v/migration-planner/pull/1231 | [email protected] | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kebev2v migration assessment | < 0.13.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 10, 2026 | New CVE Received | [email protected] |