Cyber Resilience

CVE-2026-53470

Critical

Published: 10 June 2026

Published
10 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0028 19.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-53470 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Kebev2V Migration Assessment. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Cloud Storage (T1530); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA)…

more

images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.

CWE(s)
CWE-639

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1530 Data from Cloud Storage Collection
Adversaries may access data from cloud storage.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Bypass of ownership check on S3 presigned URLs directly enables unauthorized retrieval of cloud-stored OVA images (T1530) containing JWTs and configs (T1552).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

kebev2v
migration assessment
≤ 0.13.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-24 Access Control Decisions
addresses: CWE-639

Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.

AC-3 Access Enforcement
addresses: CWE-639

Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.

References