CVE-2026-71297
MediumCVSS 5.4Summary
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Risk Assessment
Authentication bypass can lead to leakage of sensitive data and manipulation of agent status, threatening system integrity.
Recommendation
It is recommended to update the maestro gRPC broker to a patched version and review authentication mechanisms to ensure that valid client certificates are properly validated.
Other vulnerabilities in maestro
See all- CVE-2026-71299Medium
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
- CVE-2026-71298Medium
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Original NVD description (English source)
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS