CVE-2026-71297
Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 5, 2026
- Updated
- Oct 6, 2026
- Reserved
- Aug 5, 2026
Description
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Multicluster Engine for KubernetesRed Hat | |
Multicluster Engine for KubernetesRed Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-71297vdb-entry
- RHBZ#2511518issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.