Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-71297 EUVD-2026-92711GHSA-99qh-3h9r-vq6x

Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

Published Oct 5, 2026 · Updated Oct 6, 2026 · Assigned by redhat

Description

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

Affected products

VendorProductAffectedFixed
Red Hat Multicluster Engine for Kubernetes — —

References