CVE-2026-71297

MediumCVSS 5.4/10Last modified Oct 6, 2026

Description

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Multicluster Engine for Kubernetes	—
Red Hat	Multicluster Engine for Kubernetes	—

References

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-712986.4A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API CVE-2026-712996.5A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote att CVE-2026-71307.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /aj CVE-2026-713009.8Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 befor CVE-2026-713014.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.CVE-2026-713027.1The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attack CVE-2026-713037.7Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was crea CVE-2026-713077.7Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication w CVE-2026-713088.1Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replace CVE-2026-713098.6rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclo CVE-2026-71317.3A vulnerability has been found in code-projects Online Lot Reservation System up to 1.0. The impacted element is an unknown function of the CVE-2026-713105.9rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HT