CVE-2026-53473
MEDIUM WAF: High
CVSS 5.4
Published: 2026-06-10
CWE-79
A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's Red Hat Single Sign-On (SSO) session, potentially leading to unauthorized cross-tenant data access and API actions.
WAF Coverage Analysis
Cross-Site Scripting (XSS)
High WAF Coverage
OWASP: A03:2021 Injection
941xxx - XSS / XXE
Affected Software
| Vendor | Product | Version |
|---|---|---|
| kubev2v | migration_planner_ui | up to 0.13.5 |
References
- access.redhat.com (Third Party Advisory)
- bugzilla.redhat.com (Issue Tracking, Third Party Advisory)
- github.com (Patch)