---
title: "CVE-2026-53475: Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication"
url: https://erroneo.us/security/cve/CVE-2026-53475/
description: "CVE-2026-53475 (github.com/kubev2v/assisted-migration-agent (Go)): A flaw was found in assisted-migration-agent. The application hardcodes insecure…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-10
date_modified: 2026-08-14
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-53475"
kev: false
cvss: 9.3
epss: 0.00503
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-53475: Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 42: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 42% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes github.com/kubev2v/assisted-migration-agent (Go) < 0.16.0, fixed in 0.16.0 . Check your lockfile, including transitive dependencies.

## What it is

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

## Affected packages

- Go `github.com/kubev2v/assisted-migration-agent` < 0.16.0 → fixed: 0.16.0

## Affected products (CVE record)

-  assisted-migration-agent: < b940fec9f5032a0801e994054d30e81d64b2942a

## Severity

- redhat CVSS 3.1: 9.3 `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.3 `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.50% probability of exploitation activity in the next 30 days; percentile 42.

## Sources

- [GitHub Advisory GHSA-8g5p-jxp9-457c](https://github.com/advisories/GHSA-8g5p-jxp9-457c)
- [CVE.org record CVE-2026-53475](https://www.cve.org/CVERecord?id=CVE-2026-53475)
- [NVD entry CVE-2026-53475](https://nvd.nist.gov/vuln/detail/CVE-2026-53475)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-53475)
- [RHBZ#2487232](https://bugzilla.redhat.com/show_bug.cgi?id=2487232)
- [github.com](https://github.com/kubev2v/assisted-migration-agent/pull/268)
- [github.com](https://github.com/kubev2v/assisted-migration-agent/commit/b940fec9f5032a0801e994054d30e81d64b2942a)

---
Source page: https://erroneo.us/security/cve/CVE-2026-53475/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt