CVE-2026-71298
MediumCVSS 6.4Summary
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Risk Assessment
An attacker can gain unauthorized access to data stored in the database, potentially leading to a breach of information confidentiality.
Recommendation
It is recommended to immediately update the maestro product to a patched version and implement validation and parameterization of SQL queries for the `orderBy` parameter.
Other vulnerabilities in maestro
See all- CVE-2026-71299Medium
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
- CVE-2026-71297Medium
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Original NVD description (English source)
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS