CVE-2026-53472
Received Received - Intake

Cross-Site Scripting in Migration Planner via Malicious Credential URL

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Red Hat, Inc.

Description
A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javascript:` URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-53472
EUVD
EUVD-2026-58664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat migration_planner *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the migration-planner component. It occurs because the AgentStatusUpdate.CredentialUrl field does not properly validate URLs. An attacker can store a malicious javascript: URL in the system. When a victim views this URL in the Red Hat Hybrid Cloud Console, it executes arbitrary JavaScript in the victim's session, potentially stealing sensitive information.

Detection Guidance

Detecting this vulnerability requires checking for stored javascript: URLs in the migration-planner database and inspecting UI rendering logic. Review Postgres database entries for AgentStatusUpdate.CredentialUrl fields containing javascript: schemes. Inspect migration-planner-ui-app code to ensure href attributes are properly sanitized before rendering.

Impact Analysis

If you are an authenticated user of the Red Hat Hybrid Cloud Console, this vulnerability could allow an attacker to execute malicious scripts in your browser session. This may lead to theft of session cookies, sensitive data exposure, or unauthorized actions performed on your behalf. The attack requires an attacker to have agent control and involves a stored payload in the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. A successful XSS attack could result in data breaches, unauthorized disclosure, or loss of data integrity, potentially leading to regulatory penalties or compliance violations.

Mitigation Strategies

Implement URL validation at the handler level to reject non-HTTP/HTTPS schemes before storage. Update the UI to avoid rendering CredentialUrl as raw href links. Apply patches if available from Red Hat. Monitor for suspicious javascript: URLs in the database and remove any malicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart