Description
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Multicluster Engine for Kubernetes | — | — |
References
- https://access.redhat.com/security/cve/CVE-2026-71298 vdb-entry
- RHBZ#2511519 issue-tracking