CVE-2026-71298

No fix known EPSS <1%CVSS 6.4

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

Published 2026-10-05 · CVE record · OSV

Products: Red Hat Multicluster Engine for Kubernetes