CVE-2026-53472

Name of the Vulnerable Software and Affected Versions migration-planner (affected versions not specified)

Description Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), which is a technique where malicious scripts are injected into trusted websites, enabling script execution in the victim's session and potentially disclosing sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.