CVE-2026-53471: Migration-planner: agent api ignores jwt source_id claim

Synopsis

An authentication bypass in JWT claim validation affects migration-planner, a tool used to plan and assess virtual-machine migrations. An attacker who holds any valid agent token can reach the affected API handlers over the network without needing elevated privileges and supply an arbitrary source_id to target other tenants. Successful exploitation allows the attacker to overwrite victim tenant inventory, plant malicious credential URLs, or corrupt migration assessments across tenant boundaries. A patched-image rebuild at version 0.13.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API handlers are exposed over the network, so the attacker must be able to reach the migration-planner agent API endpoint remotely.

• AuthenticationRequired

  Any low-privilege account holding a valid agent JWT is sufficient; no admin or elevated privileges are needed beyond that initial token.

• Victim interactionNot required

  The attacker sends crafted API requests directly; no victim user action or interaction is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free; the attacker simply supplies an arbitrary source_id in their request with no race conditions or environmental factors required.

Blast Radius

• Attacker overwrites the inventory data of any target tenant, replacing legitimate VM and infrastructure records with attacker-controlled content.
• Attacker plants malicious credential URLs in victim tenant inventory, which can redirect migration tooling or agents to attacker-controlled endpoints.
• Attacker corrupts migration assessments for victim tenants, causing incorrect or misleading planning outcomes for those organizations.
• Full collapse of tenant isolation means every tenant managed by the same migration-planner deployment is reachable as a target, not just the attacker's own tenant.