CVE-2026-71298

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71298", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-05T14:50:01.309Z", "datePublished": "2026-10-05T19:06:46.972Z", "dateUpdated": "2026-11-11T19:38:24.433Z"}, "containers": {"cna": {"title": "Maestro: sql identifier injection via properties.* search filter and orderby field", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database."}], "affected": [{"vendor": "Red Hat", "product": "Multicluster Engine for Kubernetes", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "multicluster-engine/cloudevents-conductor-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:multicluster_engine"]}, {"vendor": "Red Hat", "product": "Multicluster Engine for Kubernetes", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "multicluster-engine/maestro-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:multicluster_engine"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-71298", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511519", "name": "RHBZ#2511519", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-05T17:51:39.148Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, restrict network access to the `maestro` REST API list endpoints to trusted clients only. Implement firewall rules or network segmentation to limit exposure of the affected service. If the `maestro` service is not essential, consider disabling it."}], "timeline": [{"lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-05T17:51:39.148Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-11T19:38:24.433Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T16:53:12.678480Z", "id": "CVE-2026-71298", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T16:53:28.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71298", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T16:53:12.678480Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T16:53:23.590Z"}}], "cna": {"title": "Maestro: sql identifier injection via properties.* search filter and orderby field", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_engine"], "vendor": "Red Hat", "product": "Multicluster Engine for Kubernetes", "packageName": "multicluster-engine/cloudevents-conductor-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine"], "vendor": "Red Hat", "product": "Multicluster Engine for Kubernetes", "packageName": "multicluster-engine/maestro-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-05T17:51:39.148Z", "value": "Made public."}], "datePublic": "2026-10-05T17:51:39.148Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-71298", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511519", "name": "RHBZ#2511519", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, restrict network access to the `maestro` REST API list endpoints to trusted clients only. Implement firewall rules or network segmentation to limit exposure of the affected service. If the `maestro` service is not essential, consider disabling it."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-11T19:38:24.433Z"}, "x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"}}, "cveMetadata": {"cveId": "CVE-2026-71298", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:38:24.433Z", "dateReserved": "2026-08-05T14:50:01.309Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-05T19:06:46.972Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:multicluster_engine"], "defaultStatus": "affected", "packageName": "multicluster-engine/cloudevents-conductor-rhel9", "product": "Multicluster Engine for Kubernetes", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:multicluster_engine"], "defaultStatus": "affected", "packageName": "multicluster-engine/maestro-rhel9", "product": "Multicluster Engine for Kubernetes", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database."}], "id": "CVE-2026-71298", "lastModified": "2026-10-06T17:17:26.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.7, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71298", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T16:53:12.678480Z", "version": "2.0.3"}}]}, "published": "2026-10-05T20:17:25.267", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-71298"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511519"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "maestro: SQL identifier injection via properties.* search filter and orderBy field", "id": "2511519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511519"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "status": "draft"}, "cwe": "CWE-89", "details": ["A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, restrict network access to the `maestro` REST API list endpoints to trusted clients only. Implement firewall rules or network segmentation to limit exposure of the affected service. If the `maestro` service is not essential, consider disabling it."}, "name": "CVE-2026-71298", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Fix deferred", "package_name": "multicluster-engine/cloudevents-conductor-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Fix deferred", "package_name": "multicluster-engine/maestro-rhel9", "product_name": "Multicluster Engine for Kubernetes"}], "public_date": "2026-10-05T17:51:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71298\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71298"], "statement": "This vulnerability is rated as Moderate severity because exploitation is restricted to read-only, blind data extraction without the capability to alter database contents or execute arbitrary commands. In Red Hat Multicluster Engine for Kubernetes environments, Maestro endpoints are typically deployed within internal cluster networks, limiting external exposure to untrusted parties. Consequently, while successful queries can disclose sensitive metadata through timing or boolean inference, system integrity and service availability remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}]}, "product": "maestro", "vendor": "maestro"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "multicluster_engine_for_kubernetes", "vendor": "redhat"}], "created": "2026-10-05T21:15:15.064889+00:00", "updated": "2026-10-06T20:57:15.118703+00:00", "vendors": ["maestro", "maestro$PRODUCT$maestro", "redhat", "redhat$PRODUCT$multicluster_engine_for_kubernetes"]}