Vulnerability · Published Jun 10, 2026 · Assigned by redhat
CVE-2026-53476Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write
Critical 9.6
In plain English
A critical-severity security flaw in assisted-migration-agent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kubev2v/assisted-migration-agent | 0.16.0 | GHSA-7j4w-x8x8-5mvg |
| Go | github.com/kubev2v/assisted-migration-agent | 0.16.0 | GO-2026-6231 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| assisted-migration-agent | 0 – before bcae0438ad8386321a300413d71c982a11b7b5b7 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-53476 vdb-entry, x_refsource_REDHAT
- RHBZ#2487233 issue-tracking, x_refsource_REDHAT
- https://github.com/kubev2v/assisted-migration-agent/pull/256