CVE-2026-53476

CRITICAL EPSS 20.8%
Published Jun 10, 20263w ago · Modified Jun 17, 20262w ago
9.6 CVSS 3.1
Critical
Find Similar
Published Jun 10, 2026 3w ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

CVSS Details

Base Score
9.6
Exploitability
2.8
Impact
6.0
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
20.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-59

Affected Products 1

VendorProductVersionRange
kubev2vassisted_migration_agent* <2026-06-07

References 3

  • access.redhat.com https://access.redhat.com/security/cve/CVE-2026-53476
    Third Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2487233
    Issue TrackingThird Party Advisory
  • github.com https://github.com/kubev2v/assisted-migration-agent/pull/256
    Patch

Remediation

  • github.com https://github.com/kubev2v/assisted-migration-agent/pull/256
    Patch