Bug 2487073 (CVE-2026-53472) - CVE-2026-53472 migration-planner: credentialUrl Validator Accepts javascript: URLs
Summary: CVE-2026-53472 migration-planner: credentialUrl Validator Accepts javascript:...
Keywords:
Status: NEW
Alias: CVE-2026-53472
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-09 17:55 UTC by OSIDB Bzimport
Modified: 2026-06-10 13:53 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-09 17:55:20 UTC 
Repository: migration-planner  
Priority: Medium  
Location: internal/handlers/validator/rules.go:11

Description:  
AgentStatusUpdate.CredentialUrl field is tagged validate:"url". go-playground/validator's url rule only checks RFC-3986 well-formedness, so javascript:alert(document.cookie) passes. Value is stored in Postgres and rendered as clickable link in migration-planner-ui-app inside Hybrid Cloud Console .

Security Impact:  

Backend persistence gate for stored XSS in Red Hat hybrid-cloud console

Requires agent control alone, but chains with f003→f002 for any authenticated user to plant javascript: URL in another org's source

Script execution in victim's Hybrid Cloud Console  session

Fix Suggestion:  
Parse URL at handler and reject anything whose scheme is not http or https before reaching service layer. UI should also stop rendering this field as raw href, but backend must not store malicious payload. See patches/f001.patch.
Note You need to log in before you can comment on or make changes to this bug.