Description
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
Published: 2026-10-05
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized write operations via Maestro REST API leading to data integrity issues and potential denial of service
Action: Apply Workaround
AI Analysis

Impact

Maestro’s REST API write endpoints were registered without authentication middleware, allowing a remote attacker to perform unauthorized write operations such as creating, modifying, or deleting consumers and resource bundles. This vulnerability can compromise data integrity and may lead to service disruption. The weakness corresponds to CWE‑306, improper restriction of undue privileges.

Affected Systems

The affected product is Red Hat Multicluster Engine for Kubernetes. No specific version information is provided in the CNA data, indicating that all versions of this product are potentially impacted unless mitigated at the deployment level.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, and the EPSS score is not available, suggesting no current data on exploit probability. The vulnerability is not listed in the CISA KEV catalog. The lack of authentication middleware allows unauthenticated remote attackers to exploit the exposed API endpoints, posing a moderate risk to the integrity and availability of the Multicluster Engine environment.

Generated by OpenCVE AI on October 5, 2026 at 21:02 UTC.

Remediation

Vendor Workaround

To mitigate this issue, disable the OpenShift Route for the Maestro component if external authentication is not configured. This can be achieved by setting `route.enabled=false` in the Maestro Helm chart configuration. Alternatively, implement an external authentication layer, such as an Istio AuthorizationPolicy, NetworkPolicy, or oauth-proxy, to secure the exposed REST API endpoints. Disabling the route may impact functionality that relies on external access to Maestro's REST API.

OpenCVE Recommended Actions

  • Disable the OpenShift Route for Maestro by setting "route.enabled=false" in the Helm chart configuration to block external access to the REST API.
  • Implement an external authentication layer such as an Istio AuthorizationPolicy, NetworkPolicy, or oauth‑proxy to secure the exposed REST API endpoints.
  • Apply the latest Red Hat update or patch for Multicluster Engine when it becomes available to resolve the authentication deficiency.

Generated by OpenCVE AI on October 5, 2026 at 21:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Maestro
Maestro maestro
Redhat multicluster Engine For Kubernetes
Vendors & Products Maestro
Maestro maestro
Redhat multicluster Engine For Kubernetes

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 05 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
Title Maestro: maestro: rest api write endpoints registered without authentication middleware
First Time appeared Redhat
Redhat multicluster Engine
Weaknesses CWE-306
CPEs cpe:/a:redhat:multicluster_engine
Vendors & Products Redhat
Redhat multicluster Engine
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Maestro Maestro
Redhat Multicluster Engine Multicluster Engine For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-07T20:13:41.092Z

Reserved: 2026-08-05T14:50:01.309Z

Link: CVE-2026-71299

cve-icon Vulnrichment

Updated: 2026-10-07T20:13:35.327Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-05T20:17:25.430

Modified: 2026-10-07T21:17:16.700

Link: CVE-2026-71299

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T17:38:22Z

Links: CVE-2026-71299 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:57:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function