CVE-2026-53474: Migration-planner: second-order sql injection via rvtools upload

Synopsis

A second-order SQL injection vulnerability affects migration-planner versions before 0.13.5. A remote attacker with a low-privilege account can upload a specially crafted RVTools .xlsx file; malicious SQL embedded in spreadsheet cells is executed when the application processes cluster names, requiring no further victim interaction. Successful exploitation gives the attacker arbitrary file read access on the host, exposing Kubernetes service account tokens and other credentials, which can lead to full SaaS environment compromise. A patched-image rebuild at version 0.13.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the migration-planner service over the network to submit the malicious file upload.

• AuthenticationRequired

  A valid account is needed, but any low-privilege account is sufficient; no administrative rights are required.

• Victim interactionNot required

  No user interaction is needed after the file is uploaded; the SQL payload executes when the application processes the cluster name field.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout dependencies are required.

Blast Radius

• Reads arbitrary files on the host system, including Kubernetes service account tokens and other credential files stored on disk.
• Exposes any secrets or configuration files accessible to the migration-planner process, including database credentials and API keys.
• Harvested credentials can be used to pivot into the broader Kubernetes cluster or SaaS infrastructure, enabling a full environment compromise.