What’s Vulnerable › Vulnerabilities

CVE-2026-53475: Assisted-migration-agent: tls verification disabled on all vcenter connections

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-06-17
• Weakness: CWE-295

Description

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Affected products

• Kubev2V Assisted Migration Agent: before 2026-06-10 — fixed in 2026-06-10

How to fix

Upgrade to a fixed version: Kubev2V Assisted Migration Agent 2026-06-10. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2026-53475
• https://bugzilla.redhat.com/show_bug.cgi?id=2487232
• https://github.com/kubev2v/assisted-migration-agent/pull/268

Get alerted when CVE-2026-53475 or the next vulnerability affects your stack