CVE-2026-71298
Description
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Statement
This vulnerability is rated as Moderate severity because exploitation is restricted to read-only, blind data extraction without the capability to alter database contents or execute arbitrary commands. In Red Hat Multicluster Engine for Kubernetes environments, Maestro endpoints are typically deployed within internal cluster networks, limiting external exposure to untrusted parties. Consequently, while successful queries can disclose sensitive metadata through timing or boolean inference, system integrity and service availability remain unaffected.
Mitigation
To mitigate this vulnerability, restrict network access to the `maestro` REST API list endpoints to trusted clients only. Implement firewall rules or network segmentation to limit exposure of the affected service. If the `maestro` service is not essential, consider disabling it.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.4 | N/A | 6.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Red Hat CVSS v3 Score Explanation
Reconciled from source finding FIND-004 (migration 2026-09-01)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
