CVE-2026-53476: critical vulnerability in assisted-migration-agent
Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write
Published
Follow this CVE+ Monitor assisted-migration-agent+ Monitor github.com/kubev2v/assisted-migration-agent
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.6epss 0.3%
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
assisted-migration-agentRelated CVEs — assisted-migration-agent
In the same product, most dangerous first.