CVE-2026-71299
MediumCVSS 6.5Summary
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
Risk Assessment
An attacker could modify or delete critical resources, potentially leading to data integrity issues or service disruption.
Recommendation
Implement proper authentication for all REST API write endpoints in Maestro.
Other vulnerabilities in Maestro
See all- CVE-2026-71298Medium
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
- CVE-2026-71297Medium
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Original NVD description (English source)
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS