GHSA-6xvf-9742-48w2

Source

https://github.com/advisories/GHSA-6xvf-9742-48w2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6xvf-9742-48w2/GHSA-6xvf-9742-48w2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6xvf-9742-48w2

Aliases

Published

2026-06-10T15:31:33Z

Modified

2026-08-18T15:11:05Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Details

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.

Database specific

{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-13T20:51:50Z",
    "nvd_published_at":  "2026-06-10T15:16:41Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/kubev2v/migration-planner

Package

Name: github.com/kubev2v/migration-planner; View open source insights on deps.dev
Purl: pkg:golang/github.com/kubev2v/migration-planner

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6xvf-9742-48w2/GHSA-6xvf-9742-48w2.json"