CVE-2026-71297: Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-306

Description

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2: all versions

References

https://access.redhat.com/security/cve/CVE-2026-71297
https://bugzilla.redhat.com/show_bug.cgi?id=2511518

Get alerted when CVE-2026-71297 or the next vulnerability affects your stack