Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-53476: Assisted Migration Agent allows file write via crafted archive

CVE-2026-53476 · published 4 months ago

Summary

The Assisted Migration Agent component can be tricked by someone on the same local network to place any file it wants on the system. By sending a specially made compressed archive, the attacker bypasses checks and writes files, which could later be used to run unauthorized programs. Updating to a version that validates archive contents or applying the provided fix will stop this issue.

What to do

Update github.com kubev2v to version 0.16.0.
Update kubev2v assisted_migration_agent to version 2026-06-07 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	kubev2v	assisted_migration_agent	< 2026-06-07 `cpe:2.3:a:kubev2v:assisted_migration_agent::::::::`
go	github.com	kubev2v	< 0.16.0 Fix: upgrade to 0.16.0

Original advisory text

Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53476... Vendor Advisory
https://github.com/kubev2v/assisted-migration-agent Product
https://access.redhat.com/security/cve/CVE-2026-53476 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487233 Third Party Advisory
https://github.com/kubev2v/assisted-migration-agent/pull/256 Patch
https://github.com/kubev2v/assisted-migration-agent/commit/bcae0438ad8386321a300...
https://github.com/advisories/GHSA-7j4w-x8x8-5mvg
https://nvd.nist.gov/vuln/detail/CVE-2026-53476 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-59Link Following

CWE-22Path Traversal

Timeline

Published10 Jun 2026

Updated3 Nov 2026

First seen10 Jun 2026

Sources

CVE-2026-53476 · NVD

GHSA-7j4w-x8x8-5mvg · GHSA

CVE-2026-53476 · OSV

Track software like this

Free during beta