SQL Injection in Kebev2v Migration Assessment
CVE-2026-53474
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (41.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-53474 (Third Party Advisory, vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Third Party Advisory, Issue Tracking)
- github.com/kubev2v/migration-planner/pull/1231 (Patch)
Frequently asked questions
- What is CVE-2026-53474?
- CVE-2026-53474 is a critical-severity vulnerability in Kebev2v Migration Assessment, classified under SQL Injection. CVSS score: 9.6/10. Published 2026-06-10.
- How severe is CVE-2026-53474?
- Critical severity. CVSS v3 base score is 9.6 out of 10.