CVE-2026-53470: Migration-planner: getsourcedownloadurl missing organization check

Synopsis

An improper access control vulnerability in migration-planner allows an authenticated attacker to bypass an ownership check on the `/api/v1/sources/{id}/image-url` endpoint. The flaw is reachable over the network and requires only a low-privilege account; no additional user interaction is needed. Successful exploitation lets the attacker retrieve presigned S3 URLs for OVA images belonging to other users, download those images, extract long-lived JWTs and source configurations, and use those credentials to access and modify the victim's migration sources. A patched-image rebuild at version 0.13.5 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the migration-planner API service remotely.

• AuthenticationRequired

  Any low-privilege account on the platform is sufficient; the attacker does not need admin rights, but must hold valid credentials.

• Victim interactionNot required

  The attacker calls the API directly and does not need any action from the targeted user.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors are required to trigger the ownership check bypass.

Blast Radius

• The attacker downloads OVA images belonging to other users, which contain long-lived agent JWTs that remain valid after exfiltration.
• Extracted JWTs grant the attacker authenticated access to the victim's migration source, enabling unauthorized reads of source configurations including host credentials and network topology.
• Using the stolen credentials, the attacker modifies the victim's migration source settings, which can redirect or corrupt an in-progress workload migration.