Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-71299

Maestro: maestro: rest api write endpoints registered without authentication middleware

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Maestro Redhat
Products
Maestro Multicluster Engine Multicluster Engine For Kubernetes
CVE-2026-71298

Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Maestro Redhat
Products
Maestro Multicluster Engine Multicluster Engine For Kubernetes
CVE-2026-71297

Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Maestro Redhat
Products
Maestro Multicluster Engine