Openshift Migration Advisor Vulnerability: Critical Data Deletion Risk
- Severity
- HIGH
- Affected component
- github.com/kubev2v/migration-planner (go)
- Affected versions
- < 0.13.5
- Patched version
- Not yet available
An authenticated user can reportedly exploit a vulnerability in the Openshift Migration Advisor by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.
What happened
The Openshift Migration Advisor is under investigation for a critical vulnerability that allows an authenticated user to send a DELETE request to the /api/v1/sources API route. This route reportedly lacks proper authorization and filtering, enabling the deletion of all customer data. The affected component is the github.com/kubev2v/migration-planner package, specifically versions less than 0.13.5.
The vulnerability, tracked as GHSA-6XVF-9742-48W2 and CVE-2026-53469, was first flagged on June 10, 2026. It has not been reported as exploited in the wild. The issue lies in the insufficient access controls for the DELETE /api/v1/sources route, which can lead to a critical loss of data availability and integrity for the entire SaaS platform.
What to do about it
- Review and audit the access controls for the DELETE /api/v1/sources route in your Openshift Migration Advisor setup.
- Monitor the github.com/kubev2v/migration-planner repository and the GitHub Advisory Database for updates on a fixed version.
- No official fix has been published yet. Monitor the sources below for updates on a patched version.
- Consider implementing additional temporary access controls or restrictions on the DELETE /api/v1/sources route until a fix is available.
- Communicate with your team and stakeholders about the potential risk and the steps being taken to mitigate it.
How 0Day would have caught this
github.com/kubev2v/migration-planner is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the github.com/kubev2v/migration-planner package in versions less than 0.13.5.
What should I do right now?
Review your access controls for the DELETE /api/v1/sources route and monitor for updates on a fixed version of the github.com/kubev2v/migration-planner package.
Is there a patched version available?
No official fix has been published yet. Continue to monitor the sources for updates.
How severe is this vulnerability?
The severity of this vulnerability is classified as HIGH due to the potential for critical data loss across the entire SaaS platform.