CVE-2026-53476: Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write

Synopsis

A path traversal vulnerability in assisted-migration-agent allows an unauthenticated attacker on the same local network to write arbitrary files to the host system by delivering a specially crafted gzipped tarball containing chained symbolic links. The attacker must be reachable on the LAN but needs no credentials and requires no user interaction. Successful exploitation gives the attacker full read, write, and availability impact on the affected appliance, including the ability to execute unauthorized code. A patched-image rebuild at commit bcae0438ad8386321a300413d71c982a11b7b5b7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network (LAN or VPN segment) as the target appliance; remote internet-based exploitation is not possible without prior network access.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the attacker can deliver the malicious tarball without authenticating to the service.

• Victim interactionNot required

  The exploit completes without any action from a user or administrator on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or other environmental factors need to align for it to succeed.

Blast Radius

• Reads any file accessible to the migration agent process, including credentials, private keys, and configuration data stored on the appliance.
• Writes or overwrites arbitrary files on the host filesystem, including binaries, service configurations, and startup scripts.
• Achieves remote code execution by planting malicious files in locations that are later executed by the operating system or application runtime.
• Crashes or degrades the migration agent service by overwriting critical files, disrupting in-flight workload migrations.