CVE-2026-53470

Name of the Vulnerable Software and Affected Versions migration-planner (affected versions not specified)

Description An improper access control flaw exists in the '/api/v1/sources/{id}/image-url' endpoint. An authenticated attacker can bypass ownership checks to obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. This allows the unauthorized download of OVA images containing sensitive data, including source configurations and long-lived agent JSON Web Tokens (JWTs), which are compact, URL-safe means of representing claims to be transferred between two parties. This could lead to unauthorized access and modification of the victim's source.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.