The maestro gRPC broker contains a flaw that allows a remote attacker with a valid client certificate to bypass authentication. This defeats the intended access controls and permits the attacker to subscribe to other consumers' event streams, which can reveal confidential information. The attacker can also publish forged agent status, compromising the integrity of the data propagated through the broker.

The affected product is Red Hat Multicluster Engine for Kubernetes. No specific version range is listed in the advisory, so all deployments of this product are considered at risk until a patch or configuration change is applied.

The CVSS score of 5.4 places the vulnerability in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker who possesses a valid client certificate; such an attacker can directly interact with the gRPC broker over the network. Because client mTLS is optional, the broker lacks proper authentication checks, enabling the described data disclosure and integrity attacks.