CVE-2026-71297

Published: Oct 5, 2026Modified: Oct 6, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://access.redhat.com/security/cve/CVE-2026-71297

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2511518

Source: secalert@redhat.com

Timeline

No history available yet.