What’s Vulnerable › Vulnerabilities

CVE-2026-53476: Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-06-17
• Weakness: CWE-59

Description

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

Affected products

• Kubev2V Assisted Migration Agent: before 2026-06-07 — fixed in 2026-06-07

How to fix

Upgrade to a fixed version: Kubev2V Assisted Migration Agent 2026-06-07. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2026-53476
• https://bugzilla.redhat.com/show_bug.cgi?id=2487233
• https://github.com/kubev2v/assisted-migration-agent/pull/256

Get alerted when CVE-2026-53476 or the next vulnerability affects your stack