The flaw resides in the orderBy query parameter used by maestro’s REST API list endpoints. A remote actor can inject crafted SQL fragments without authentication, forcing the underlying database to execute unintended queries. The injection is blind but allows extraction of read‑only data, compromising confidentiality. The attacker cannot modify data or execute arbitrary code; the impact is limited to data exposure.

The vulnerability affects Red Hat Multicluster Engine for Kubernetes deployments. No specific version information is provided.

The CVSS score of 6.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited over the network through the publicly exposed maestro REST API endpoints without any authentication. Because the attack only yields read‑only access, the likelihood of exploitation on a system that is properly segmented is reduced, but the potential for confidential data leakage remains a concern.