CVE-2026-71298 — Maestro: sql identifier injection via properties.* search filter and orderby field

CVE-2026-71298

Maestro: sql identifier injection via properties.* search filter and orderby field PUBLISHED

Description (CNA)

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

Affected (CNA)

Vendor / product	Versions
Red Hat / Multicluster Engine for Kubernetes	affected
Red Hat / Multicluster Engine for Kubernetes	affected

CWE

CWE-89

References

https://access.redhat.com/security/cve/CVE-2026-71298
https://bugzilla.redhat.com/show_bug.cgi?id=2511519

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.