Vulnerability · Published Oct 5, 2026 · Assigned by redhat
CVE-2026-71298Maestro: sql identifier injection via properties.* search filter and orderby field
Medium 6.4
In plain English
A medium-severity SQL injection in Multicluster Engine for Kubernetes from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 76.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Multicluster Engine for Kubernetes | see references |
| Red Hat | Multicluster Engine for Kubernetes | see references |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-71298 vdb-entry, x_refsource_REDHAT
- RHBZ#2511519 issue-tracking, x_refsource_REDHAT