CVE-2026-71299 — Maestro: maestro: rest api write endpoints registered without authentication middleware

CVE-2026-71299

Maestro: maestro: rest api write endpoints registered without authentication middleware PUBLISHED

Description (CNA)

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).

Affected (CNA)

Vendor / product	Versions
Red Hat / Multicluster Engine for Kubernetes	affected
Red Hat / Multicluster Engine for Kubernetes	affected

CWE

CWE-306

References

https://access.redhat.com/security/cve/CVE-2026-71299
https://bugzilla.redhat.com/show_bug.cgi?id=2511520

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.