CVE-2026-53474 Migration-planner: second-order sql injection via rvtools upload

What is CVE-2026-53474?

CVE-2026-53474 is a critical SQL injection vulnerability in kebev2v:migration_assessment, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Weakness: CWE-89

Which versions are affected by CVE-2026-53474?

3 open source packages ship an affected version, including github.com/kubev2v/migration-planner. It affects 1 product.

Products include Kebev2v Migration Assessment.

How do I fix CVE-2026-53474?

Upgrade github.com/kubev2v/migration-planner to 0.13.5 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-53474 being exploited?

There is no known exploitation of CVE-2026-53474 in the wild and no public exploit code.

Other vulnerabilities in kebev2v:migration_assessment

• CVE-2026-53470 Migration-planner: getsourcedownloadurl missing organization check Critical 9.6
• CVE-2026-53471 Migration-planner: agent api ignores jwt source_id claim Critical 9.6
• CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vf2h-7x3w-97fr, GO-2026-6233.