CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).

Score

CVSS 3.1 6.5 Medium

Status

Awaiting Analysis - secalert@redhat.com

Published

2026-10-05

Last modified

2026-10-07

Weaknesses

CWE-306

Affected products

• Multicluster Engine (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2026-71299
• https://bugzilla.redhat.com/show_bug.cgi?id=2511520